Following a series of personal-information leaks at financial institutions, President Lee Jae-myung (이재명) ordered a thorough investigation and measures to address the problem on Sunday, October 4. According to the Blue House (청와대), Lee received a briefing on recent leaks at financial institutions and public agencies, as well as each institution’s response. Presidential spokesperson Kang Yoo-jung (강유정) said the president viewed the matter as serious and had instructed officials to conduct a thorough investigation and work on measures to address it.

The leaked information went beyond names and phone numbers. It also included annual income and loan limits, and some customers’ resident registration numbers were exposed. Reports have also said that AI-based cyberattacks targeting financial institutions are on the rise, but it has not yet been confirmed how the individual incidents occurred or how AI was actually used.

Background and context

The incidents occurred at major financial companies over the course of several days. Shinhan Bank (신한은행) reported a leak on Thursday affecting about 25,000 people, and similar cases were reported at KB Kookmin Bank (KB국민은행), Hana Bank (하나은행) and BNK Busan Bank (BNK부산은행) on Friday. The leaks were subsequently reported to have spread beyond major banks to non-bank financial institutions, including savings banks, capital companies and mutual finance institutions.

One point of concern is the nature of the leaked information. Names and phone numbers can be used to identify or contact customers, while annual income and loan limits reveal their financial circumstances. The fact that some resident registration numbers were also included underscores the need to investigate the scope of the damage and the measures taken to protect the information. However, there has been no overall accounting of which information was leaked at each institution or how much was exposed.

In a post on X last month, on the 30th, Lee said he intended to strengthen fines and criminal penalties for businesses handling personal information when leaks occur, and make it easier to obtain civil compensation through class-action lawsuits. This was reported as the president’s proposed direction for responding to such incidents; it does not represent the findings of the investigation into these leaks or a confirmed change in policy.

What this news means

For customers who may have been affected, it matters which information was exposed. If a name and contact details are leaked together, and income or loan information is added to the mix, it may be harder to distinguish genuine communications from messages that seem to know a person’s actual financial circumstances. This is a potential concern arising from the combination of exposed information; it does not mean that impersonation or other additional harm linked to these incidents has been confirmed.

For example, if a customer whose leaked information includes annual income and a loan limit receives a message posing as a financial consultation, it is safer not to assume it is genuine just because it contains specific details. Since the information exposed and the causes of the individual incidents have not yet been made public, the specific risks may vary from customer to customer.

It has become important for financial companies to establish how the incidents occurred and determine the scope of the damage. The information customers need to be told and the measures to prevent further harm may depend on the investigation’s findings. Based on the reporting available so far, it is not possible to confirm whether each institution has notified customers or what compensation or remedies may be available.

What reports described differently

Reports differed in how they characterized the connection between AI and these incidents. One report said AI-based cyberattacks targeting financial institutions are on the rise, while another said the incidents were suspected of involving AI. It therefore cannot be stated as confirmed that AI was actually used in each of the leaks.

What is confirmed and what is still unknown

Confirmed facts

  • President Lee Jae-myung received a briefing on personal-information leaks at financial institutions and public agencies and their responses, and ordered a thorough investigation and measures to address the problem.
  • Shinhan Bank reported a leak affecting about 25,000 people, and similar cases were reported at KB Kookmin Bank, Hana Bank and BNK Busan Bank.
  • The exposed information included names, phone numbers, annual income and loan limits; some customers’ resident registration numbers were also exposed.
  • The leaks were reported to have spread beyond major banks to non-bank financial institutions.

What is still unknown

  • The methods and causes of each incident, and whether AI was actually used in individual incidents, have not been disclosed.
  • The total number of affected customers, including those at non-bank financial institutions, and the total volume of leaked information have not been confirmed.
  • The findings of the investigation, notifications to affected customers, measures to prevent further harm and remedies have not yet been announced.

What readers can check

  • You can check whether the financial institution you use has sent you a notice about a data leak and whether the notice says your information was included.
  • Even if you receive a financial consultation or loan offer, do not rely solely on the sender’s information; it is advisable to verify the message through the financial institution’s official contact channels.
  • When investigation findings and follow-up notices from individual institutions become available, check whether they explain the scope of the damage and the measures and inquiry procedures that apply to you.

References