Korea orders every bank and card firm to audit exposed systems after leaks at four lenders
South Korea's Financial Services Commission ordered banks and card firms to check every externally reachable IT system after data leaks at four banks. The regulator will collect the returns and use them to build new cybersecurity measures for the financial sector.
The Investor · Invest desk
What happened
- The attacks involved AI agents and hit less-secure systems, including Shinhan Bank's service for loan agents and KB Kookmin Bank's mobile work app for employees.
- Shinhan Bank said on Thursday that data on about 25,000 customers leaked after code related to its communications infrastructure was hacked.
- Industry sources told Yonhap the Shinhan attackers are suspected to be based overseas and used advanced artificial intelligence tools.
- Woori Bank and NH Nonghyup Bank were reportedly hit by similar attacks but blocked unauthorized access, so no personal data leaked, Yonhap said.
- A police division in charge of cyberterror response has opened a preliminary probe into the series of bank hacks.
Why it matters
- What it costs cost Card companies with no reported breach now pay for the same system inventory and checklist review as the four banks that leaked data.
- Who has to decide decision Each firm has to decide, system by system, whether to cut what it exposes externally or put authentication in front of internal data, the two fixes the FSC named.
- Who's exposed exposure The four breached banks will compensate customers for any losses under the authorities' oversight, so their bill grows with whatever the leaked data is later used for.
Next story · Invest · 2d ago
Hacking that began at Korean banks has reached 16 financial firms, including Gopax's operatorConfirmed3 publishers
The order's scope follows the route the attackers took. Neither of the two systems named in the attacks is a customer channel [3]. The checks cover every system reachable from outside, whether or not it serves customers and whatever service it offers [4]. The first task is an inventory of all IT assets and services exposed to external access, then a review of their vulnerabilities and access controls [4].
The damage disclosed so far is concentrated. KB Kookmin's own review found more than 100 customers affected [8], and Hana Bank put its count at 89, with resident registration numbers among the leaked fields [9]. Add Shinhan's figure and the three disclosed counts come to about 25,200 customers [20], with Shinhan accounting for about 99% of them [21]. BNK Busan also leaked data, according to financial industry sources cited by the Korea Herald [10], though no count has been reported. Six banks have now been named as targets, and four of them leaked data [22].
For now the FSC is collecting self-reviews against a checklist it will supply [13]. It has sent inspectors from the Financial Supervisory Service and the Financial Security Institute only to the four banks that leaked [19]. If the returns show unauthenticated routes into internal data at banks and card firms alike, the regulator has its case for binding requirements. If the inspections trace the four leaks to a shared component, the fix lands on a supplier and any rule can stay narrow. And if Woori and NH Nonghyup, the two banks that blocked the attacks [17], turn out to be typical, the case is for enforcing controls the banks already run.
I think the sector-wide reading holds on scope and is unproven on rules. The order itself makes the scope sector-wide [1], and the FSC has tied the measures it promised to these returns [12]. "We will thoroughly analyze the causes and methods of the attacks and swiftly develop measures to strengthen the system," said Shin Jin-chang, the FSC secretary general who chaired the emergency meeting [15] [2]. The thesis is wrong if what follows is the same checklist made permanent, with no new requirement attached.
What the four banks end up paying depends on what leaked. Shinhan's exposed fields were annual income, names and phone numbers [7]. "People will only feel reassured once it is confirmed that the leaked information was not directly related to their financial transactions," a financial industry official said, according to the Korea Herald [16].
What to watch
- The FSC's summary of the checklist returns, and whether it finds unauthenticated routes to internal data at firms beyond the four breached banks.
- Findings from the on-site inspections at Shinhan, KB Kookmin, Hana and BNK Busan, especially whether the leaks trace to a shared component or supplier.
- A customer count for BNK Busan and the first compensation figures from any of the four banks.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
South Korea's Financial Services Commission on Friday ordered banks and credit card companies to conduct security checks following a series of cyberattacks involving Shinhan Bank and KB Kookmin Bank.
- [2]
The FSC held an emergency meeting chaired by Secretary General Shin Jin-chang, who called on banks and card companies to conduct comprehensive checks of all IT systems accessible from outside their networks.
- [3]
Relatively less-secure systems, including Shinhan Bank's service for loan agents and KB Kookmin Bank's mobile work-support system for employees, were targeted in attacks involving artificial intelligence agents.
- [4]
The FSC instructed financial companies to identify all IT assets and services exposed to external access and examine security vulnerabilities and access controls; checks should cover all externally accessible systems regardless of whether they are customer-facing or what type of service they offer.
- [5]
Companies were told to minimize information exposed externally, check for routes allowing access to internal information without authentication, and ensure authentication is applied whenever internal information is accessed.
- [6]
Shinhan Bank said Thursday that information belonging to about 25,000 customers had been leaked after a code related to its communications infrastructure was hacked.
- [7]
Shinhan Bank said the leaked personal information included annual income, names and phone numbers.
- [8]
KB Kookmin Bank found during its own review that information on more than 100 customers had been leaked following an external intrusion.
- [9]
Hana Bank said personal information of 89 customers, including resident registration numbers, names, addresses and phone numbers, was leaked in a hacking attack.
- [10]
Hana Bank and BNK Busan Bank were also found to have suffered information leaks on Friday, according to financial industry sources.
- [11]
Sources said Shinhan Bank was attacked by hackers, currently suspected to be based overseas, who used advanced artificial intelligence tools.
- [12]
The FSC said it would promptly collect the results and use them to develop measures to strengthen cybersecurity in the financial sector.
- [13]
Financial authorities will provide a cybersecurity checklist for financial companies' own reviews and will collect the results.
- [14]
The authorities will oversee affected financial companies to ensure they take appropriate measures to protect customers and compensate them for any losses.
- [15]
"We will thoroughly analyze the causes and methods of the attacks and swiftly develop measures to strengthen the system."
- [16]
"People will only feel reassured once it is confirmed that the leaked information was not directly related to their financial transactions."
- [17]
Woori Bank and NH Nonghyup Bank were said to have suffered similar hacking attacks, but no personal information leaked because they blocked unauthorized access to their systems.
- [18]
A police division in charge of cyberterror response has begun a preliminary probe into the series of bank hacks.
- [19]
The Financial Supervisory Service and Financial Security Institute have dispatched personnel to all four banks where data breaches have been reported to conduct on-site inspections.
- [20]
The three disclosed customer counts (Shinhan, KB Kookmin, Hana) add to about 25,189, or roughly 25,200 customers.
- [21]
Shinhan accounts for about 99% of the disclosed affected customers.
- [22]
Six banks have been named as attack targets across the two reports; four leaked customer data and two blocked access.
Sources
2 independent publishers whose own reporting we read for this story.
- en.yna.co.kr(2nd LD) Regulator instructs financial firms to check security systems over series of cyberattacks on banks
1 article · October 2, 2026
- koreaherald.comFSC orders banks, card firms to conduct security checks
1 article · October 2, 2026