South Korean exchange Coinone confirmed that an attacker broke into the server of MetaM, its outsourced customer support contractor, and viewed or leaked customer support records. The intrusion happened around 4 a.m. on November 12, and the contractor reported it to Coinone the same morning.

Exposed data may include names, phone numbers, resident registration numbers, bank account numbers, passwords, home addresses and wallet addresses shared during chat or phone support.

Coinone says member accounts, trading and wallet systems run separately from the MetaM server and shows no sign of a direct breach. Only users who contacted support are affected. The exchange moved support to email, blocked the attacking IPs and reported the incident to KISA, the Personal Information Protection Commission and the Financial Supervisory Service.

Users who shared passwords with support are urged to change them on Coinone and any service using the same password, and to ignore anyone posing as Coinone who asks for OTP codes, withdrawals or wallet address changes. Affected customers may seek statutory damages of up to 3 million won.