On Sunday, President Lee Jae-myung called for a thorough investigation into personal data leaks at financial institutions. A spokesperson for the Presidential Office (대통령실) said Lee had received a briefing on recent leaks at financial and public institutions and the measures taken in response. Other reports said the president instructed authorities to treat the matter seriously, investigate it thoroughly and focus on developing countermeasures.

Customer information was reportedly leaked, or hacking attempts were made, at a series of financial companies, including major banks. Reports named Hana Bank (하나은행), KB Kookmin Bank (KB국민은행) and Shinhan Bank (신한은행) as institutions affected by leaks, but the reported scale of the impact and scope of leaked information at each institution vary in the level of detail.

Background and context

The issue was reported not as a single institution’s incident but as a series of personal data breaches at multiple financial institutions. One report said customer information belonging to about 25,000 people was leaked at Shinhan Bank. The leaked information reportedly included names, phone numbers and annual income. Sources also said hackers had used advanced artificial intelligence tools, but the attack method was not presented as a confirmed fact.

The same report said personal information belonging to 89 customers was leaked at Hana Bank. Woori Bank (우리은행) and NH Nonghyup Bank (NH농협은행) were also targeted in similar hacking attempts, but reportedly blocked unauthorized access and suffered no personal data leaks. The report also said the chair of the Financial Services Commission (금융위원회) and the governor of the Financial Supervisory Service (금융감독원) held an emergency meeting with executives from the affected financial companies.

Another report said similar incidents had been reported at KB Kookmin Bank, Hana Bank and BNK Busan Bank (BNK부산은행), following the incident at Shinhan Bank. It also said that, in addition to names and phone numbers, annual income and loan limits—and the resident registration numbers of some customers—had been exposed. There were also reports that the incidents had spread beyond financial institutions to nonbank financial institutions.

The chair of the Financial Services Commission was reported to have said that multiple security breaches had been identified across several sectors in a short period. He said it appeared that no sensitive information that could be used for unauthorized payments had been leaked so far, but warned that the leaked information could be used for voice phishing or other scams and urged the financial sector to maintain a high level of vigilance. He was also reported to have said that the possibility of artificial intelligence tools being used in the hacking could not be ruled out.

What this means

The risks to customers from a data leak can vary depending on which information was exposed. Even when names and contact details are leaked, the possibility of scam calls using that information has been raised, so the impact of a personal data leak cannot be determined solely from the statement that payment information has not been found. In particular, because reports differ on the information leaked at each institution, the incidents should be assessed separately based on each institution’s findings, rather than treated as one uniform type of breach.

For example, if you use one of the banks involved, it is important not only to check whether the bank has been named as an affected institution, but also to find out whether your own information was affected and which items were exposed. This does not mean that all customers were affected. Based on the information reported so far, it is not possible to determine whether an individual was affected or needs to take additional steps.

The most important information for customers to look for next is therefore the scope of the breach confirmed by the financial institution and what it tells customers—not speculation about the suspected method of attack.

Points that differ across reports

The institutions named and the scope of the leaked information vary from report to report. One report gave specific figures and information categories for leaks at Shinhan Bank and Hana Bank, and said Woori Bank and NH Nonghyup Bank had blocked hacking attempts and suffered no leaks. Another report also mentioned cases at KB Kookmin Bank and BNK Busan Bank, and said some resident registration numbers and loan limits had been exposed.

Accordingly, the scale of the impact and the information leaked at every institution have not been presented as one definitive list. In particular, the figures of about 25,000 people at Shinhan Bank and 89 at Hana Bank come from one report; they should not be applied to other institutions or interpreted as the total number of people affected.

What is confirmed and what remains unknown

Confirmed

  • President Lee received a briefing on personal data leaks at financial and public institutions and the measures taken in response, and called for a thorough investigation and countermeasures.
  • A series of customer data leaks or hacking attempts at multiple financial companies was reported.
  • Reports included cases involving about 25,000 people at Shinhan Bank and 89 people at Hana Bank.
  • The chair of the Financial Services Commission was reported to have warned that leaked information could be used for voice phishing and other scams.

What remains unknown

  • When each hacking attack occurred, and the final number of people affected and scope of leaked information at each institution.
  • Who was behind the attacks, the specific methods used to gain access, and whether artificial intelligence tools were actually used in the attacks.
  • What measures and timelines will be included in the investigation called for by the president and in each financial institution’s response.

What readers should check

  • Check what notices the financial institution you use has issued about leaks or hacking attempts, and review the stated scope of the impact and the information exposed.
  • In light of the financial regulator’s warning that leaked information could be misused in scams, verify any contact claiming to represent a financial institution—or asking for additional personal information—against the institution’s official guidance.
  • When the findings of follow-up investigations or further guidance from institutions become available, check them separately from earlier reports. The information publicly available so far cannot confirm whether any particular individual’s data was leaked.

References