South Korean President Orders Full Security Checks After Financial Sector Hacks

Key Takeaways

• South Korean President Lee Jae Myung has mandated a comprehensive security audit across the financial sector following a spate of data breaches.
• Multiple financial institutions, including Shinhan Bank, KB Kookmin Bank, Hana Bank, and others, have reported compromises affecting customer and employee data.
• Exposed information ranges from names, phone numbers, and income details to sensitive resident registration numbers.
• Investigators are currently examining the potential role of AI-powered automation tools in these attacks, though no definitive link or fully autonomous AI hack has been confirmed.

South Korea Mandates Full Security Review After Financial Sector Breaches

South Korean President Lee Jae Myung has ordered an exhaustive investigation into a series of cyberattacks that have compromised sensitive customer and employee data across the nation’s financial sector. The directive, issued on October 4, 2026, comes amidst ongoing scrutiny into whether advanced AI tools facilitated these breaches into banking and financial firm systems.

According to reports from The Korea Times, President Lee received a detailed briefing on the recent security incidents impacting both financial and public institutions, along with the immediate response measures. Presidential spokesperson Kang Yu-jung conveyed President Lee’s instruction for officials to conduct a thorough investigation and formulate robust countermeasures, emphasizing “a grave awareness of the seriousness of the matter.”

Widespread Data Breaches Impact Multiple Institutions

The wave of breaches began with Shinhan Bank reporting a compromise on October 1, affecting approximately 25,000 customers. Data exposed in this incident included names, phone numbers, annual income figures, and loan limit details. Critically, some resident registration numbers, which are highly sensitive personal identifiers collected during loan application processes, were also leaked.

Further disclosures followed on October 2 from KB Kookmin Bank and Hana Bank. KB Kookmin Bank revealed that personal and credit information belonging to 119 customers was accessed through a mobile work-support system utilized by its employees. Hana Bank reported abnormal access to its operations support system, which resulted in the exposure of data for 89 customers. Hana’s compromised records included names, resident registration numbers, addresses, email addresses, phone numbers, and employment details. Separately, BNK Busan Bank confirmed the exposure of information pertaining to 11 outsourced workers. These incidents highlight distinct groups of affected individuals, rather than a single unified pool of bank customers.

The scope of the attacks extended beyond traditional banks to non-bank financial entities. Yegaram Savings Bank disclosed a personal information leak impacting around 40,000 customers, while Hyundai Capital reported the exposure of data for 146 housing loan agents. This broadening pattern of compromise has intensified focus on the security protocols across the entire financial ecosystem.

Investigation into AI Involvement Continues

Reporting by Seoul Economic Daily indicated the discovery of traces of an AI-based automation tool in the Shinhan Bank incident. Additionally, SBS reported that common IP addresses were identified across attacks on several financial institutions.

However, investigators have yet to publicly confirm whether a single threat actor orchestrated all the breaches or if AI autonomously executed each attack. The ongoing investigation aims to clarify these critical distinctions.

The precise role of AI is a significant point of inquiry. While an AI tool’s presence might suggest advanced capabilities, it does not fully explain the entire attack chain. Public reports have not identified a specific software vulnerability, a known malware family, or a complete set of attack indicators. Therefore, characterizing these incidents as entirely autonomous AI-driven hacks would extend beyond the currently available evidence.

Reported entry points for the attacks included loan-agent websites and employee support systems, rather than direct customer banking applications. The Korea Times noted that both KB Kookmin Bank and Hana Bank stated their affected systems were isolated from internet and mobile banking platforms, confirming that no customer financial transaction information was compromised in those specific incidents.

Police initiated their examination of the breaches on October 2, coinciding with financial authorities ordering extensive checks of computer systems at banks and card companies. These findings underscore the critical importance of securing supporting business systems, as they frequently house sensitive records even when primary customer banking platforms remain unaffected.

While not directly connected to the current incidents, the “Korean Leaks” campaign, which previously targeted South Korea’s financial sector through a compromised service provider, offers relevant context. Furthermore, the potential for AI-driven phishing highlights why exposed personal details are a serious concern: sophisticated, tailored messages can leverage leaked data to launch highly convincing follow-up scams against affected individuals.

What You Should Do

• For Financial Institutions: Immediately conduct comprehensive security audits of all internal and external-facing systems, especially employee support portals and third-party vendor access points. Review and strengthen access controls, multi-factor authentication, and intrusion detection systems. Implement enhanced monitoring for anomalous activity, particularly from new or unusual IP addresses.
• For Customers and Employees: Be highly vigilant for phishing attempts and suspicious communications, particularly those that appear to contain personal information. Do not click on unsolicited links or download attachments from unknown sources. Regularly monitor financial statements and credit reports for any unauthorized activity. Consider enabling multi-factor authentication on all financial and sensitive online accounts.
• For Regulators and Policymakers: Expedite investigations into AI involvement to understand the evolving threat landscape. Develop and enforce updated cybersecurity regulations and guidelines that address emerging attack vectors and technologies, ensuring robust protection for sensitive financial data.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.