On October 4, 2026, President Lee Jae-myung received a briefing on personal information leaks at financial institutions and public agencies and ordered a thorough investigation and the preparation of countermeasures. On October 1–2, a series of hacking attacks believed to have used artificial intelligence (AI) targeted at least six banks in South Korea, including Shinhan Bank (신한은행), KB Kookmin Bank (KB국민은행), Hana Bank (하나은행), Woori Bank (우리은행), NH Nonghyup Bank (NH농협은행), and BNK Busan Bank (BNK부산은행). Some customer personal information was confirmed to have been leaked at Shinhan, KB Kookmin, and Hana banks, while information about outsourced employees was leaked at BNK Busan Bank.

The Financial Services Commission (금융위원회) called on banks and credit card companies to conduct a comprehensive inspection of their IT systems. Reports also said that Financial Services Commission Chairman Lee Eog-weon and Financial Supervisory Service (금융감독원) Governor Lee Chan-jin held an emergency review meeting with financial industry association heads and the CEOs of financial companies affected by the incident. This matter does not end with confirming that attacks occurred. The next step—determining what information was actually leaked and how far it spread, and what safeguards financial companies will put in place—will shape the risks facing customers.

Background and context

The attacks were not limited to a single bank; they occurred in succession at several financial institutions over a short period. According to reports, at least six banks were targeted. Some reports also said that similar attacks had been reported in the non-bank financial sector, including savings banks, capital companies, and mutual finance institutions. However, reports so far have described the use of AI in the attacks as presumed or possible.

Reports also provided specific details about the institutions where leaks were confirmed and the amount of information involved. One report said that the names, phone numbers, and annual incomes of about 25,000 Shinhan Bank customers were leaked, and that a leak of personal information affecting 89 people was confirmed at Hana Bank. There were also accounts that Woori Bank and NH Nonghyup Bank had faced similar attacks but blocked unauthorized access, with no personal information leaked. These figures and details are what has been reported; they cannot be assumed to represent the full scale of the damage or the final findings of the investigation.

What this news means

What matters to customers is not only that “hacking occurred,” but whether their information was actually leaked and what information was exposed. If information that could be combined with other details to impersonate someone—such as a name or contact information—was leaked, the possibility of subsequent voice-phishing or targeted fraud attempts cannot be ruled out. The Financial Services Commission chair’s warning at the meeting that leaked information could be exploited for voice phishing and other scams also underscored the need to guard against secondary harm after a data leak.

The head of the financial authorities said that, so far, no sensitive information that could be used to make unauthorized payments appeared to have been leaked, while urging the financial sector to maintain a high level of vigilance.

For example, even if someone contacts a customer of one of the banks pretending to offer loan advice or verify an account, the customer should not assume the contact is genuine just because the caller knows personal information. However, the information currently available does not confirm that any particular customer received such a call or suffered actual secondary harm. That is why it is important to see whether the findings of investigations by financial companies and authorities are reflected in specific notices to customers and follow-up measures.

The president’s order called for an investigation and the preparation of countermeasures; it does not mean that the attack routes or the scope of the leaks have been established. Even as the financial authorities’ IT checks and reviews by individual financial companies proceed, it remains to be determined what information was taken and what measures will be offered to affected customers. For now, therefore, it is worth focusing less on the phrase “AI hacking” and more on the specific details in investigation findings and notices from each financial company.

Points reported differently

Reports gave different accounts of when the emergency review meeting took place. Some said that Financial Services Commission Chairman Lee Eog-weon and Financial Supervisory Service Governor Lee Chan-jin were scheduled to hold a meeting on the afternoon of October 4, while others reported that the meeting had taken place and that the commission chair had spoken at it. This appears to reflect differences in reporting times and updates, but the exact time cannot be established from this information alone.

What is confirmed and what remains unknown

Confirmed facts

  • On October 4, President Lee received a briefing on personal information leaks and ordered a thorough investigation and the preparation of countermeasures.
  • On October 1–2, at least six South Korean banks were targeted in hacking attacks believed to have used AI.
  • Some customer personal information was confirmed to have been leaked at Shinhan, KB Kookmin, and Hana banks, and a leak of outsourced employee information was reported at BNK Busan Bank.
  • The Financial Services Commission called on banks and credit card companies to conduct comprehensive inspections of their IT systems.

What remains unknown

  • Who was behind the hacking attacks, and what were the specific methods used to gain access?
  • What was the total scale of the leaks, and what information was taken from each institution?
  • What follow-up measures will each financial institution take, and what information will it provide to affected customers, based on the investigation findings?

What readers should check

  • Check official notices from your bank or financial company to see whether you were affected and what information was leaked.
  • If someone contacts you claiming to offer loan advice or verify your account, do not trust them simply because they know your personal information. Verify the contact through your financial company’s official channels.
  • Check whether the financial authorities and individual financial companies publish investigation findings and follow-up measures. Reports so far have not disclosed the full scope of the damage or the measures taken by each institution.

References