On October 4, 2026, Financial Services Commission (금융위원회) Chairman Lee Eok-won held an emergency meeting with the entire financial sector at Government Complex Seoul and called on the sector to exercise the highest level of vigilance, saying that breaches had occurred in quick succession across several industries, including banks, savings banks and capital companies. He said the possibility of attacks using artificial intelligence (AI) could not be ruled out. However, he said there was no evidence so far that sensitive customer information that could be used directly for fraudulent payments or similar activity had been leaked.

Background and context

One notable aspect of these incidents is that the targets reportedly included areas that had received relatively less attention in security management, such as business-support systems, external webpages and servers, rather than internet and mobile banking services used directly by customers. Chairman Lee said cases had been confirmed in which external webpages and servers used by loan agents or employees for work-related convenience were exploited in attacks. This means that even if a financial firm’s core transaction systems are not affected, gaps in connected work environments can still lead to the exposure of personal information.

At the October 4 meeting, Chairman Lee said that if similar incidents occurred because firms had neglected necessary inspections and responses despite attack information and incident reports already being shared across the financial sector, those responsible would be held strictly accountable under the relevant laws and regulations. The meeting was attended by the heads of associations representing the banking, financial investment, insurance, credit finance, savings bank, mutual finance, virtual asset and fintech industries, as well as executives from financial firms affected by breaches. President Lee Jae-myung was also reported to have received a briefing on personal-information leaks and responses at financial and public institutions, and to have ordered a thorough investigation and measures to address the problem.

Information-leak cases confirmed in other reports included the names, phone numbers, annual incomes, employers and partial resident registration numbers of about 25,000 Shinhan Bank (신한은행) customers; information on 119 KB Kookmin Bank (KB국민은행) customers; and information on 89 Hana Bank (하나은행) customers. Reports said information on 11 outsourced development employees at Busan Bank (부산은행) had been exposed. Yegaram Savings Bank (예가람저축은행) announced that the names, dates of birth and contact details of about 40,000 customers had been leaked, and Hyundai Capital (현대캐피탈) was reported to have become aware that information on 146 loan agents had been leaked.

What this news means

However, when details about income, employment or loans are added to names or contact information, they can be used for voice phishing or smishing in which callers or senders approach people as if they know the details of their actual financial consultations. The risk therefore extends beyond “access to accounts”: leaked information can also make fraudulent calls or messages seem more credible, which is why the issue has drawn attention.

For example, someone who sought a loan consultation from a financial firm and whose information was included in a leak might mistake a call or text that appears to know the details of the consultation for a genuine message from the firm. This is a hypothetical example explaining a possibility; it does not mean that any particular customer has actually received such a call or message. Chairman Lee also said the possibility of secondary harm, such as voice phishing or smishing using leaked information, could not be ruled out.

Financial firms face questions about their responsibility not only to maintain technical defenses, but also to inspect external webpages and servers and business-support systems, and to check whether they responded to known attack information. The authorities said they would hold firms accountable under the law for similar incidents resulting from inadequate inspections or responses. Reports have also said that financial firms are individually notifying customers and providing guidance on preventing harm. Customers who receive notice that their information has been leaked should therefore check what the notice says and what the firm’s compensation policy is in the event of actual harm.

Differences in what reports have said

The lists of places where “information leaks have been confirmed” vary depending on the timing and scope of the reports. Coverage of the Financial Services Commission chairman’s meeting cited Shinhan, KB Kookmin, Hana and BNK Busan Bank, as well as Hyundai Capital, Yegaram Savings Bank and Welcome Savings Bank (웰컴저축은행), as cases in which leaks had been confirmed. Other reports said similar attacks had occurred at Woori Bank (우리은행) and NH NongHyup Bank (NH농협은행), but had not resulted in actual leaks; they also described intrusion attempts at the Saemaul Geumgo Federation (새마을금고중앙회) and NongHyup mutual finance (농협 상호금융). It is therefore important to distinguish between places that were attacked or faced attempted attacks and those where information leaks were confirmed.

Welcome Savings Bank reported to the authorities the previous day that, based on its own review, it estimated that information related to corporate customers involving as many as 2,200 records had been leaked. The customers and types of information involved differ from those in the personal-customer leak figures described in detail in other reports, so the figures cannot be added together or compared as a single overall measure of harm. The reports available do not establish whether the final scope of the leaks at each financial firm has been determined.

What is confirmed and what is not yet known

Confirmed facts

  • On October 4, the Financial Services Commission chairman held an emergency meeting with the entire financial sector and called for the highest level of vigilance.
  • Cases have been confirmed in which areas that received relatively less attention in security management, including external webpages and servers and business-support systems, were targeted.
  • The Financial Services Commission chairman said there was no evidence so far that sensitive customer information that could be used directly for fraudulent payments or similar activity had been leaked.
  • Welcome Savings Bank reported to the authorities that it estimated that as many as 2,200 records of information related to corporate customers had been leaked.

Not yet known

  • The perpetrators behind the attacks and the specific methods used to gain access have not been identified.
  • It is not known whether the types and total volume of information leaked at each financial firm have been finalized.
  • It has not been confirmed whether AI was actually used in the attacks.

What readers should check

  • If you receive a notice from a financial firm about a leak, check what information was exposed, when it was exposed and whether your information was included.
  • Check the recommended precautions and the firm’s compensation policy if harm occurs. For suspicious calls or texts claiming to be from a financial firm, verify whether they are genuine through the firm’s official channels.
  • Reports said financial firms would individually notify affected customers of the leaks and explain how to prevent secondary harm, and that they would fully compensate customers for harm caused by these leaks. Check the relevant financial firm’s guidance for the actual conditions and procedures.

References