Five South Korean Banks Attacked, Three Experiencing Customer Data Leaks
Shinhan, KB Kookmin, Hana, Woori, and NH Nonghyup banks have all suffered external attacks or intrusion attempts. The first three have confirmed customer information leaks, while Woori and Nonghyup blocked unauthorized access and found no personal information leaks. Busan Bank also reported a leak of information for 11 outsourced personnel.
Shinhan confirmed on Wednesday and disclosed on Thursday that information for about 25,000 loan applicants was leaked. Attackers bypassed identity verification to access a mobile inquiry service used by loan intermediaries to check application progress. Exposed information includes names, phone numbers, annual income, and estimated loan amounts, along with 66 resident registration numbers and 97 CI identification numbers used for online verification. The bank has blocked external addresses and suspended the service.
KB Kookmin stated on Friday morning that data for 119 customers was leaked through an employee mobile support system, including names, phone numbers, addresses, and resident registration numbers, which were in encrypted format and varied by individual. Earlier industry reports suggested over 100 individuals were affected. The bank discovered the anomaly on Wednesday night and has blocked relevant servers and access paths. Hana reported the same day that hackers accessed the outdoor sales support system (ODS), which is isolated from online banking and mobile banking transaction systems, leaking resident registration numbers, names, addresses, contact information, and employer names for 89 customers, while transaction information remained secure.
After comparison, the financial and cybersecurity departments found that some IP addresses attacking Shinhan and KB Kookmin overlapped, indicating the possibility of a common perpetrator. Security analysts discovered traces of the open-source penetration tool ARTEX AI on servers suspected to be related to the Shinhan attack, with a page title containing the Chinese phrase "AI Autonomous Penetration Testing Console." Banks and financial authorities have not yet officially confirmed that this tool was used for the intrusion. Regulatory investigations are ongoing.
Financial supervisory authorities have requested financial institutions to check their computer security systems. The police have initiated an investigation. All banks stated that customer transaction information was not leaked and promised to compensate for any resulting losses. Hana has apologized to its customers.
This is not a case of deposits being siphoned off. The buyers are external visitors seeking loan progress and identity and income fields in the employee mobile support system; the sellers are those who opened the inquiry interface to intermediaries and employees but failed to block bypassing verification by the bank. The incident was driven by multiple access points during the same period, not a bank run. Benefiting are Woori and Nonghyup, which have blocked access paths and can declare "no leaks"; under pressure are Shinhan with its 25,000 loan application records, and KB Kookmin and Hana, which need to explain the whereabouts of resident registration numbers to customers. The money remains in accounts, but verification materials have already been exposed.
Source: Public Information
ABAB AI Insight
Large South Korean banks have experienced outsourcing leaks in the past year. Woori stated in July 2026 that an external software vendor's employee improperly retained and uploaded connection information and nicknames for 17,551 customers, with phone numbers, resident registration numbers, and addresses remaining intact; the data came from a list provided for a non-fungible token platform developed in September 2024. This incident involving five banks plus Busan Bank represents a different line: the entry points are in loan intermediary inquiries, employee mobile support, and outdoor sales systems, not in the core transaction ledger.
No ransom figures have been disclosed. Shinhan has blocked external addresses and suspended inquiry services, KB Kookmin blocked servers on Wednesday night, and Hana emphasized that ODS is isolated from online banking. Regulatory actions include financial supervisory authorities requiring the entire industry to check security systems, and police have filed a case. Overlapping IP addresses link Shinhan and KB Kookmin as potentially from the same source, while traces of ARTEX AI remain discovered by analysts, but authorities have not confirmed its use. The tool is an open-source large model penetration testing platform, not the banks' own model.
This can be compared to multiple institutions after 2023 treating outsourcing and intermediary interfaces as leak points rather than the main server room. The MoveIT and Snowflake token leaks also occurred through auxiliary systems. The industry position is not that the core ledger was altered, but that identity verification and loan progress inquiries were treated as low-protection interfaces. The numbers 25,000 versus 119 versus 89 indicate which inquiry platform was bypassed, not which bank is larger.
Structurally, the attack surface has shifted from the vault to auxiliary systems. The mechanism is that loan intermediaries and employee mobile terminals must remain active; once identity verification can be bypassed, annual income, limits, and resident registration numbers can leave with the inquiry results. The transaction system isolation can prevent transfers but cannot stop verification materials. Compensation promises address post-incident losses but do not recover already exposed registration numbers.
ABAB News · Cognitive Laws
The ledger is untouched, but identity can be lost first.
Opening inquiry interfaces to intermediaries adds another door to verification.
Tool traces do not equal authorities having reached a conclusion.