South Korean authorities probe cyberattacks on major commercial banks

South Korean financial authorities have opened a formal investigation into a series of cyberattacks that targeted major commercial banks and institutions, leaking personal data belonging to tens of thousands of customers. The National Police Agency registered the case on October 6, 2026, after preliminary reviews indicated potential violations of the country’s information and communications network act, as reported by Yonhap.

National Police Launch Specialized Cyber Terror Unit

The National Police Agency assigned the probe to the cyber terrorism investigation unit due to the severity of the incidents, Yonhap reported. The specialized investigative task force consists of 28 investigators split across four distinct teams under the leadership of the cyber terrorism response division chief. Authorities stated they will cooperate closely with relevant institutions to conduct a swift and rigorous investigation aimed at easing public anxiety.

Banks Report Data Leaks and Extent of Breaches

Multiple large financial institutions faced attacks during the wave of breaches, including Shinhan Bank, KB Kookmin Bank, Hana Bank, Woori Bank, and NH Nonghyup Bank. Shinhan Bank reported on October 1, 2026, that unauthorized access exposed personal information for approximately 25,000 customers, including names, phone numbers, and annual income details, according to Yonhap. Shinhan Bank announced on Thursday that around 25,000 customers had personal data leaked, prompting the financial regulatory authority to conduct an on-site inspection, after loan-related data, annual income, and phone numbers were compromised the previous day due to a hack. Shinhan Bank activated its emergency response system and took necessary emergency measures, including blocking foreign IP addresses and suspending related services to limit potential damage from the leak, while the Financial Supervisory Service dispatched a team to inspect the data leak. Hana Bank experienced a smaller leak affecting 89 customers, while Woori Bank and NH Nonghyup Bank blocked unauthorized access attempts without suffering confirmed data leaks, Yonhap reported. Within a few days, Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, and other financial companies reported security incidents, with customer information exposed in some cases including customer names, phone numbers, income data, credit limits, and identity data.

President Lee Orders Investigation into Financial Breaches

South Korean President Lee Jae-myun ordered a thorough investigation and directed authorities to take all necessary measures to address the breaches and prevent future occurrences, Yonhap reported. Financial Services Commission Chairman Lee Ok-won and Financial Supervisory Service Governor Lee Chan-jin convened an emergency meeting with representatives from affected financial institutions and regulatory bodies, according to Yonhap. Regulators warned financial companies to maintain peak vigilance and directed institutions to conduct immediate security checks, restrict access to external systems, and rapidly share threat intelligence regarding attacker internet protocol addresses across the sector, Yonhap noted.

Attackers Use AI Tools to Scan Financial Firms

Sources indicated that attackers utilized advanced, AI-driven tools during the assault on Shinhan Bank, reflecting a growing sophistication in methods used to probe infrastructure and accelerate breach phases. Financial regulators told lawmakers that the cyberattacks appeared designed to scan numerous financial firms for security vulnerabilities rather than targeting a single institution, and traced traffic origins to IP addresses in countries including the United States, Japan, Singapore, Vietnam, and Britain, according to Yonhap. Meanwhile, the opposition People Power Party called on authorities to investigate potential links to North Korea given historical cyber threats from Pyongyang, Yonhap reported.

Financial Authorities Expand On-Site Inspections and Cyber Frameworks

The Financial Services Commission chairman stated that authorities cannot rule out the possibility that artificial intelligence was used in the attacks, calling for an approach of countering AI attacks with AI, while also pointing to broader updates to the cybersecurity framework in the financial sector. The financial regulatory agency stated that authorities launched on-site investigations after Shinhan Bank reported a breach on September 30, and have since expanded the scope of investigations to include other reported incidents.

Yonhap