President demands a thorough investigation
President Lee Jae-myung has instructed officials to investigate a series of personal-data breaches affecting financial institutions and public agencies, and to prepare measures to prevent further incidents. His direction came after receiving a briefing on the reported breaches and how the organizations involved have responded.
“Approach this matter with the utmost seriousness, conduct a thorough investigation, and make every effort to prepare countermeasures,” Lee said, according to a statement from senior presidential spokesperson Kang Yu-jung.
The instruction signals that the government is treating the incidents as a significant security concern. The available information does not yet establish the full number of affected customers, the total amount of data exposed, or whether the different incidents were connected.
Reports span major banks and smaller lenders
The incidents reportedly include cyberattacks targeting Shinhan Bank, KB Kookmin Bank, Hana Bank, and BNK Busan Bank. Reports also describe breaches at other financial businesses, including savings banks, capital firms, and mutual-finance organizations.
These institutions handle information that can identify customers or help criminals contact them convincingly. Depending on what was accessed, personal information may be used to impersonate a bank, pose as a loan adviser, or tailor a fraudulent message to a particular person. The reports cited in the original account do not establish that all of these kinds of information were exposed in every incident.
- Large commercial banks serve millions of customers and operate extensive online services.
- Savings banks and capital firms provide services such as deposits and loans, often to different customer groups from major banks.
- Mutual-finance organizations include community-based financial institutions that also store customer records.
The reported spread across different types of organizations raises questions about whether attackers found a shared weakness or used separate methods. Investigators will need to establish how each system was accessed and whether any stolen data was transferred or misused.
AI is suspected, but its role remains unclear
The attacks have been described as possibly involving artificial intelligence (AI), technology that enables computers to perform tasks such as analyzing information or generating text. However, the reports do not confirm precisely whether attackers used AI, what tools they may have used, or how much the technology contributed to the breaches.
AI can potentially help criminals work faster—for example, by drafting convincing messages or adapting a scam to details about a person. But a plausible-sounding message is not proof that AI was involved, and the label “AI-enabled” does not by itself explain how a system was penetrated. Investigators must determine whether the incidents involved stolen passwords, weaknesses in software, deception of employees, or another route.
Why the distinction matters
Identifying the actual method is essential to choosing effective defenses. If an attacker used a stolen password, stronger login checks may help; if a software flaw was exploited, organizations may need to repair vulnerable systems and review access controls. A broad claim about AI cannot replace a technical investigation into what happened.
Lee had already warned companies about penalties
Three days before the latest instruction, on September 30, Lee wrote on X about how organizations that handle personal information should be held accountable. He said that, in the event of a breach, companies could face fines so large that they exceed the cost savings they made, strong criminal penalties, and civil compensation through class-action lawsuits made easier for affected people to pursue.
Those comments were a warning about the consequences he wants companies to face; they do not mean that new penalties have already taken effect. Any changes would depend on the applicable laws and government action. The core policy message, however, was clear: protecting customer data should be treated as a basic responsibility, not an optional expense.
Lee’s stated approach links data security to accountability: companies that fail to protect information could be required to pay far more than they saved by cutting security costs.
What investigators and financial firms need to establish
A thorough inquiry should identify what information was accessed, when the intrusion began, how long it continued, and whether the attackers reached systems beyond the initial point of entry. It should also determine whether the reported incidents share a connection or are separate cases.
For customers, the distinction between confirmed exposure and possible risk is important. If contact details or other personal information are involved, criminals may use them to make calls or messages seem genuine. Customers should be cautious about unexpected requests for passwords, verification codes, or money, and should contact their financial institution through an independently verified number or official app if they are unsure.
Financial organizations, meanwhile, may need to review access permissions, strengthen login protections, monitor systems for unusual activity, and ensure that staff can report suspicious events quickly. These are general safeguards; the appropriate response will depend on what investigators find in each case.
A test of trust in digital finance
Banks and other financial firms rely on digital systems to provide everyday services, from checking balances to applying for loans. That convenience also means institutions hold large volumes of sensitive information in interconnected systems. A breach can therefore create risks beyond the initial intrusion, including follow-up scams that exploit customers’ trust in familiar financial brands.
The government’s next steps will help show whether Lee’s call for stronger accountability leads to specific investigations, preventive measures, and changes to penalties. For now, officials face two immediate tasks: establish the facts behind each reported breach and give affected customers clear, timely information. The confirmed findings—not assumptions about AI—will determine what protections and consequences are warranted.
