Shinhan, KB Kookmin, Hana, Woori, and NH Nonghyup banks have all suffered external attacks or intrusion attempts. The first three have confirmed customer information leaks, while Woori and Nonghyup blocked unauthorized access and found no personal information leaks. Busan Bank also reported a leak of information for 11 outsourced personnel.

Shinhan confirmed on Wednesday and disclosed on Thursday that information for about 25,000 loan applicants was leaked. Attackers bypassed identity verification to access a mobile inquiry service used by loan intermediaries to check application progress. Exposed information includes names, phone numbers, annual income, and estimated loan amounts, along with 66 resident registration numbers and 97 CI identification numbers used for online verification. The bank has blocked external addresses and suspended the service.

KB Kookmin stated on Friday morning that data for 119 customers was leaked through an employee mobile support system, including names, phone numbers, addresses, and resident registration numbers, which were in encrypted format and varied by individual. Earlier industry reports suggested over 100 individuals were affected. The bank discovered the anomaly on Wednesday night and has blocked relevant servers and access paths. Hana reported the same day that hackers accessed the outdoor sales support system (ODS), which is isolated from online banking and mobile banking transaction systems, leaking resident registration numbers, names, addresses, contact information, and employer names for 89 customers, while transaction information remained secure.

After comparison, the financial and cybersecurity departments found that some IP addresses attacking Shinhan and KB Kookmin overlapped, indicating the possibility of a common perpetrator. Security analysts discovered traces of the open-source penetration tool ARTEX AI on servers suspected to be related to the Shinhan attack, with a page title containing the Chinese phrase "AI Autonomous Penetration Testing Console." Banks and financial authorities have not yet officially confirmed that this tool was used for the intrusion. Regulatory investigations are ongoing.

Financial supervisory authorities have requested financial institutions to check their computer security systems. The police have initiated an investigation. All banks stated that customer transaction information was not leaked and promised to compensate for any resulting losses. Hana has apologized to its customers.

This is not a case of deposits being siphoned off. The buyers are external visitors seeking loan progress and identity and income fields in the employee mobile support system; the sellers are those who opened the inquiry interface to intermediaries and employees but failed to block bypassing verification by the bank. The incident was driven by multiple access points during the same period, not a bank run. Benefiting are Woori and Nonghyup, which have blocked access paths and can declare "no leaks"; under pressure are Shinhan with its 25,000 loan application records, and KB Kookmin and Hana, which need to explain the whereabouts of resident registration numbers to customers. The money remains in accounts, but verification materials have already been exposed.

Source: Public Information