A series of data breaches have hit major South Korean banks.
Instead of targeting core financial networks such as internet banking, attackers targeted peripheral systems used by employees or loan agents. Financial regulators have begun a comprehensive review of banks’ IT systems. Experts say banks need common security standards that also cover outside partners and subcontractors.
According to the financial industry on Oct. 3, 2026, Shinhan Bank’s inquiry system for loan agents was attacked for three days starting Sept. 28, exposing information belonging to 25,729 customers. Kookmin Bank said on Sept. 30 that information belonging to 119 customers was taken from a mobile business-support system used by employees. Hana Bank also said the same day that information belonging to 89 customers was exposed through its sales-support system. At BNK Busan Bank, personal information of 11 outsourced development workers was exposed on Oct. 1. Woori Bank and NH NongHyup Bank also detected abnormal external access attempts.
Some in the cybersecurity industry have raised the possibility that attackers used artificial intelligence (AI) agents to automate the attacks. The identity of the attackers and the precise methods used have not yet been confirmed.
None of the systems involved in the incidents were core financial systems. The targets included Shinhan Bank’s loan-agent inquiry service, Kookmin Bank’s mobile business-support system for employees and Hana Bank’s sales-support system, all of which have external access points.
Hwang Seok-jin, a professor at Dongguk University’s Graduate School of International Information Security, said, “All of the incidents started not in core systems but in relatively vulnerable peripheral channels.” He said the most urgent task is to identify vulnerable links rather than focus solely on penalties for individual incidents. He added that the banking industry should review external access points and authentication systems and establish common standards covering AI-based anomaly detection and third-party security management.
On third-party security management, Hwang said banks should not manage loan agents, affiliated companies, outsourced development firms, cloud providers, and entrusted and subcontracted service providers separately, but should establish common requirements for a minimum level of security across all connected parties.
Cybersecurity company AhnLab also issued a statement on Oct. 2, shortly after the incidents, saying that business systems used by employees and partners should be included in security checks. It said access rights should be verified for every application programming interface (API) request and abnormal requests, such as repeated inquiries, should be blocked. AhnLab currently describes its business as covering enterprise cybersecurity across endpoints, networks, cloud and industrial…
Read More: Four Korean Banks Suffer Data Leaks Through Peripheral Systems < IT·Gaming
