Cybersecurity

Breaches through vendors and side systems exposed personal data this week. No customer funds were reported lost

4 min read

Noir ink illustration of a chain linking plain server boxes with one cracked red link in the middle, a fishing hook dangling above an envelope, for a roundup of supply-chain breaches and phishing risk.

Coinbase, Warp, GMO and three Korean financial firms disclosed incidents this week. Most began outside the core platform, and the data taken is the kind used for convincing phishing.

In brief

In several of this week's disclosures, attackers got in through a vendor, a dependency, a server or an internal app rather than the main product. The data taken is raw material for phishing.

What was disclosed

Coinbase. "Coinbase has not had a data breach," the exchange said on X. It said its analytics vendor Amplitude "experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers". Coinbase said it found no unauthorised access to its own systems and that customer funds were not affected. It has not said how many customers were affected.

Warp. On 26 October, chief executive Zach Lloyd said Warp had found "active and narrow-banded exploitation of a vendor" in its infrastructure, likely starting with "a hole in a vendor dependency". He said a limited amount of agent trace and telemetry data was accessed, and put the upper bound at "roughly 1% of Warp users".

Daishin Securities. Personal and credit information of 38,490 customers leaked after an attack on a server linked to opening discretionary-investment accounts online, Yonhap reported. Daishin said names, email and home addresses were exposed, with account and mobile numbers encrypted, and that it has found no secondary damage.

Mirae Asset Global Investments and Bithumb. Mirae Asset Global Investments said information leaked from some internal web systems, though no investor or credit data was exposed. Bithumb detected unauthorised access to its internal mobile groupware on 27 October. Employee data is confirmed so far, and it is checking whether member data was included, Yonhap reported. (Yonhap's English service, citing an industry source, said customer data was also affected.)

The wider Korean wave. The Financial Supervisory Service has identified all three breaches, Yonhap reported. They follow a breach at Shinhan Bank reported on 30 September and one at Mirae Asset Life Insurance, which detected unusual activity on 25 October, The Korea Times and Yonhap reported.

GMO Internet. In its tenth report, GMO said attackers had published what they claim is data from its Onamae.com Desktop Cloud service, and that GMO was still verifying it. GMO warned that visiting the leak site exposes the visitor's own information to the attackers. It also said it will not pay the extortion demand of about 8 billion yen. ByteNib does not link to the leaked material.

What to do (ByteNib editorial analysis)

If you use any of these services:

  • Treat any email, SMS or call that mentions the incident as suspect. GMO warns scammers may impersonate it, and exposed Coinbase contacts are obvious phishing targets.
  • Don't use links in alerts. Open the company's site or app yourself.
  • No real company will ask for your password, a one-time code or a "recovery fee". GMO says this explicitly.
  • Use app-based or hardware-key two-factor authentication.
  • Warp users should rotate any secret that may have appeared in agent sessions.

For teams, every analytics or telemetry vendor is attack surface. List what you send each one.

Sources and scope

Figures are as stated by each company on 26–28 October 2026. Investigations are ongoing. The advice section is ByteNib editorial analysis.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.