The security failures came to light after Shinhan and KB Kookmin flagged abnormal access logs on September 30, prompting network isolation, emergency reporting to the Financial Supervisory Service (FSS), and subsequent public apologies from bank leadership. While regulators confirm no financial funds or transactional records were stolen, the leaked data includes sensitive details like resident registration numbers and annual incomes. The police have officially opened a preliminary investigation, and the Financial Services Commission (FSC) has convened an emergency summit of financial CEOs to mandate industry-wide security sweeps.
South Korea’s financial sector is on high alert after an aggressive, multi-day cyberattack targeted five major commercial banks alongside prominent secondary lenders, leaking the personal data of tens of thousands of citizens.
The cyber offensive, which unfolded between September 30 and October 3, 2026, successfully breached internal networks at Shinhan Bank (exposing ~25,000 customers), KB Kookmin Bank (119 customers), Hana Bank (89 customers), and BNK Busan Bank (11 customers). Beyond commercial banking, Yegaram Savings Bank suffered the largest single hit with roughly 40,000 customer profiles compromised, while Hyundai Capital reported the exposure of 146 loan recruiters.
Cybersecurity analysts revealed that hackers weaponized ARTEX AI, an autonomous artificial intelligence penetration testing tool, to execute highly automated credential stuffing campaigns. Rather than targeting core transactional databases, the attackers focused on weaker peripheral employee networks—including remote operations systems and external loan-agent portals.