South Korean Police Investigate Breaches at Seven Financial Firms

• Seven financial firms, including Shinhan, KB Kookmin and Hana banks, have reported data breaches.
• A Korea Times estimate puts the number affected above 67,000, but South Korea has not published a final count of unique people.
• Police have formed a 28-member team to investigate. AI use remains suspected, not established.
• Regulators have ordered a month-long response to guard against phishing and loan scams using leaked data.

The breaches exposed personal information at seven financial firms, and some intrusions went undetected for nearly five days. South Korea’s police have opened a formal investigation; the National Office of Investigation says its 28-member team is examining possible violations of information and communications network law.¹ A Korea Times report put the number affected above 67,000, but that figure is an estimate, not a final official tally.²

The firms named in that report were Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital. Reported exposures included names and contact details, as well as financial information such as income and loan limits. Some data came from support systems used by employees or loan agents rather than banks’ core banking platforms.²³

The figures do not all count the same thing. On 7 October, Aju Press reported that Welcome Savings Bank had identified 2,370 leaked records, 2,299 containing personal information; the bank had not yet converted those records into a count of unique people. Hyundai Capital said information on 146 housing-loan recruiters was exposed—not 146 retail customers.⁴

President Lee Jae Myung has said signs of AI use had emerged, and investigators are considering that possibility. Reporting has described traces associated with ARTEX, an open-source penetration-testing tool, on a server believed to be linked to the attacks. That does not establish that the tool was used to carry them out, what role AI played or who was responsible.⁵

The immediate risk for customers is that exposed details could make fraud more convincing. South Korea’s financial regulators warned that scammers might pose as lenders or bank staff, using personal and financial information to press people into clicking links, installing apps or paying fees.⁶

On 6 October, the Financial Services Commission and Financial Supervisory Service issued a consumer caution alert and began a one-month special response period. They told firms to open help desks, strengthen monitoring for suspicious transactions and share information about suspected phishing. The regulators said no phishing cases using the leaked data had yet been confirmed to have caused financial losses or stolen money—a statement about confirmed losses at that time, not proof that no attempts had been made.⁶

Footnotes

1. Yonhap, “Police launch probe into recent cyber attacks at financial firms”. ↩

2. The Korea Times, “AI-powered attacks on banks expose technological lag in Korea’s financial cyber defenses”. ↩ ↩²

3. Yonhap, report on suspected AI use, affected systems and financial-firm attacks. ↩

4. Aju Press, “Welcome Savings Bank and Hyundai Capital Unaware of Hacking for Five Days”. ↩

5. Aju Press, “Are Korea’s financial defenses ready for an AI hacker army?”; The Korea Times, report on the suspected ARTEX traces. ↩

6. Financial Services Commission and Financial Supervisory Service, consumer alert and special response measures, 6 October 2026. ↩ ↩²