News about data breach

South Korean crypto exchange Bithumb is investigating the extent of a data leak after hackers breached its in-house mobile system, which employees use for internal communication and work, earlier this week. Bithumb discovered the breach on Tuesday and notified the Korea Internet & Security Agency and the Personal Information Protection Commission the same day. The exchange said its internal work system is separated from its virtual asset trading system, so customer virtual assets could not be accessed through this breach, while it was still checking whether member data was involved. The incident is part of a wave of cyberattacks on South Korea's financial sector, with 16 financial firms hit as of October 14, according to Governor Lee Chan-jin. Daishin Securities said personal and credit information of 38,490 customers had been leaked.

Hardware wallet maker Keystone said an attacker who breached its website last week also stole a key used to verify device authenticity, which could let counterfeit wallets pass its checks. The company plans to destroy 18,835 devices in inventory that contain the compromised key and has suspended shipments of devices using it. It disclosed that 25,964 buyer records from 2024 to 2026 were stolen after a faulty data-erasure tool failed to delete them, and that 12,873 checkout records held by Shopify were also taken. Devices made and delivered before the Oct. 20 incident are considered safe, but the authenticity of later devices cannot be guaranteed. The breach follows other security issues at hardware wallet makers this year, including Ledger, Coinkite and Trezor.

Hardware wallet maker Keystone said an unauthorized third party accessed customer shipping information through a website breach, including names, contact details, shipping addresses and order details, after it confirmed the incident on Friday following a review of API activity with Shopify. The company said it has blocked access, fixed the vulnerability, opened an investigation and is emailing affected customers, but did not disclose how many were impacted. Security researcher Taylor Monahan warned the leaked addresses could expose holders to physical attacks and kidnappings, and blockchain security firm CertiK recorded 52 verified wrench attacks worldwide in the first half of 2026, up 33% from the same period last year. Some customers said they received breach notices despite buying devices more than two years ago, raising questions about Keystone’s 2023 pledge to cut data retention to 180 days. Keystone had not responded to Cointelegraph’s questions by publication time.