We checked this claim: is it true that
automated cyberattacks using artificial intelligence breached at least six South Korean financial institutions and leaked customer data from four?
four lenders confirmed data leaks while two repelled intrusions, with regulators probing suspected AI-assisted methods
Shinhan Bank breach exposes 25,000 customers
Suspected AI-driven cyberattacks breached at least six South Korean lenders, triggering emergency regulatory scrutiny.
In a nutshell
Automated cyberattacks hit South Korea's financial system in early October 2026, leveraging suspected artificial intelligence tools to breach four commercial banks and two consumer lenders while two institutions repelled intrusions. The attacks compromised roughly 25,000 records at Shinhan Bank and approximately 40,000 at Yegarum Savings Bank, prompting the Financial Supervisory Service to open on-site regulatory audits and convene an emergency industry summit.
Highlights
- Shinhan Bank suffered an unauthorized breach exposing personal and borrowing details of roughly 25,000 customers.
- Attackers compromised approximately 40,000 customer records at second-tier lender Yegarum Savings Bank as intrusions expanded.
- KB Kookmin Bank and Hana Bank confirmed breaches affecting 119 and 89 individuals respectively, while BNK Busan Bank leaked records for 11 developers.
- Woori Bank and NH NongHyup Bank successfully repelled external intrusion attempts against their systems.
- The Financial Supervisory Service launched emergency on-site inspections into security controls and convened an urgent sector summit.
Confirmed Customer Records Exposed by Lender
recordsThe findingShinhan Bank accounts for the overwhelming majority of disclosed customer data leaks among top-tier commercial banks.
- Comparison of confirmed customer data exposures across the three major commercial banks that disclosed client losses.
- records — Verified count of individual customer files exposed during the confirmed network intrusions
- Highlights varying levels of exposure across institutional targets and indicates where regulatory scrutiny and liability will concentrate.
From the Editor’s Diary
As cyberattackers deploy autonomous software to accelerate reconnaissance, perimeter security failures at peripheral entry points can rapidly expose core enterprise data across an entire financial sector.
Who's involved
Shinhan Bank
Major South Korean retail and commercial lender, unit of Shinhan Financial Group
goal → Plug system vulnerabilities, limit customer attrition, and mitigate looming regulatory fines
Financial Supervisory Service
Integrated financial oversight and regulatory agency of South Korea
goal → Inspect access controls, determine how breaches succeeded, and issue administrative penalties
Unidentified Attackers
External cyber threat collective suspected of operating from overseas
goal → Deploy autonomous AI tools to locate system flaws and harvest consumer financial dossiers
KB Kookmin Bank
Commercial banking giant in South Korea
goal → Secure mobile staff networks, halt unauthorized access, and protect customer records
Hana Bank
Major commercial bank operating across South Korea
goal → Isolate compromised operational software and halt secondary financial fraud
BNK Busan Bank
Regional retail bank headquartered in Busan
goal → Patch vulnerable external web pages and shield technical contractor data
In short
South Korea's financial system faces a structural security test after automated cyberattacks breached major lenders, demonstrating that artificial intelligence tools can rapidly identify and exploit systemic weaknesses across tier-one banks.
The campaign makes stringent regulatory sanctions and mandatory, sector-wide security overhauls likely as authorities audit how unauthorized tools bypassed perimeter defenses.
Such an outcome is likely because the Financial Supervisory Service has already launched emergency on-site inspections into institutional access controls and executive oversight.
How it unfolded
Shinhan Bank reveals mass loan-system leak
Shinhan Bank disclosed on October 1, 2026, that unauthorized outside parties compromised an external portal used by loan recruiters, harvesting the personal and financial profiles of approximately 25,000 customers.
The breach triggered immediate intervention from the Financial Supervisory Service, which deployed emergency investigators as cybersecurity analysts uncovered preliminary evidence that automated AI scripts carried out the initial reconnaissance.
Cyber intrusions spread across tier-one lenders
Within 24 hours of the Shinhan disclosure, intrusions surfaced across three more commercial lenders, confirming that the threat was not an isolated incident but a coordinated industry-wide assault.
KB Kookmin Bank discovered unauthorized access to an internal employee mobile app, exposing 119 customer files, while Hana Bank detected an abnormal entry into its back-office support system that compromised 89 customer records.
The assault reached regional banking when BNK Busan Bank reported an automated probe against an external web server on the evening of October 1, exposing session data for 11 third-party software developers. Countermeasures held elsewhere, with Woori Bank and NH NongHyup Bank successfully repelling concurrent access attempts.
Attack wave hits consumer lenders, prompting crisis summit
By October 3, the assault moved past traditional banks into consumer credit and auto-financing firms, escalating the crisis across the broader financial system.
Attackers broke into Yegarum Savings Bank, accessing approximately 40,000 customer records, and penetrated broker portals at auto financier Hyundai Capital.
The contagion forced regulators to call an emergency weekend summit with the heads of major financial institutions and industry associations, ordering systemwide password resets and technical countermeasures against AI-driven intrusion scripts.
Where things stand
Four banks—Shinhan, KB Kookmin, Hana, and BNK Busan—have confirmed customer and contractor data exposures, while Woori Bank and NH NongHyup Bank successfully fended off attacks. The wave has since extended into second-tier credit providers, where Yegarum Savings Bank reported roughly 40,000 customer records compromised.
Two central issues remain open: forensic teams have yet to establish formal attribution for the threat group, and investigators are still working to technically differentiate fully autonomous AI actions from human-directed credential abuse. The Financial Supervisory Service continues its on-site audits, with officials weighing penalties against bank management for internal oversight failures.