Two South Korean Banks Face Customer Data Leaks
Customer data breaches at Shinhan Bank and KB Kookmin Bank within days of each other have put security controls at South Korea’s major lenders under closer scrutiny, particularly systems that sit outside core internet and mobile banking networks.
Shinhan Bank disclosed that information belonging to about 25,000 customers had been exposed after an unauthorised party bypassed authentication on an externally accessible loan inquiry service.
Days later, KB Kookmin Bank reported a separate breach involving 119 customers through a mobile work-support system used by employees.
Two South Korean Banks Face Customer Data Leaks
The Shinhan Bank breach involved customer personal and credit information linked to loan applications, including names, phone numbers, annual income and calculated loan limits.
The incident began through a mobile website service used by loan agents to check application results.
Investigators found that the attacker bypassed authentication and entered customer reference numbers to retrieve information about loan applications, including requested and approved amounts.
The attacker then used customer numbers obtained from that service to access another inquiry system, which could provide further details such as names, contact information, internet banking registration status and foreign currency exchange activity.
The attack is believed to have continued for more than 15 hours, from around 9 a.m. on 29 September until the early hours of 30 September.
The exposed information also included 66 resident registration numbers, South Korea’s national identification numbers, and 97 encrypted identity-linking codes known as connecting information, or CI.
Shinhan discovered the breach at around 9 a.m. on 30 September and reported it to financial regulators.
It subsequently blocked external IP addresses, suspended the affected inquiry services and introduced a function on its website and Shinhan Super SOL app for customers to check whether their information had been exposed.
Why Is KB Kookmin Bank Also Under Investigation?
KB Kookmin Bank, South Korea’s largest lender, separately confirmed that personal and credit information belonging to 119 customers had been leaked through a mobile work-support system used by employees.
The bank detected possible abnormal external access on the night of 30 September and immediately blocked the affected server and access routes.
The leaked information varied between customers but included names, phone numbers, addresses and encrypted resident registration numbers.
KB Kookmin Bank said its internet and mobile banking systems, which handle customer financial transactions, were not affected.
The bank notified affected customers and provided guidance on preventing further damage.
It also said it would fully compensate customers for any losses resulting from the incident.
A bank representative said,
"We are taking this situation extremely seriously. We are operating an emergency response system across the entire organization and thoroughly reviewing all processes from the ground up to prevent additional damage and recurrence in the future."
Why Are External Banking Services Becoming A Security Focus?
Neither incident is understood to have directly compromised the banks' core transaction systems.
Instead, the breaches involved services with external access, including staff work-support platforms and simplified customer inquiry systems.
The Shinhan case has raised particular questions about whether authentication and access controls were properly separated between different services.
Information obtained through one inquiry service was reportedly used to gain access to another, allowing the attacker to gather more customer data.
Financial regulators are therefore examining not only the individual breaches but also how banks protect systems that connect with outside users, employees and service providers.
The Financial Supervisory Service launched an emergency on-site inspection into Shinhan Bank to establish how the breach occurred and determine the full type and volume of information exposed.
Its IT inspection team also began investigating the KB Kookmin Bank incident, while regulators planned to gather commercial bank officials to review internal security checks, external access routes and wider information security measures.
Could An AI Tool Have Been Used In The Shinhan Attack?
The Shinhan investigation has also raised the possibility that artificial intelligence may have been involved in automating parts of the attack.
Moon Jong-hyun, head of the Genians Security Center, said on LinkedIn that "the string 'ARTEX-自主渗透試控制台' was identified in some HTML titles of the web server presumed to have been used in the attack," adding that "multiple threat analysts reasonably suspect that an AI-based attack automation tool may have been used in this attack."
ARTEX AI is described as a Chinese-language system capable of automating vulnerability scanning and attack-path design.
The possible use of such technology has added another area for regulators and banks to examine, including whether similar attack methods have been used against other financial institutions.
Shinhan Had Repeatedly Passed Data Protection Reviews
The Shinhan breach has also raised questions about the effectiveness of existing security assessments.
The bank had received an S grade, equivalent to 100 points, for six consecutive years in the Financial Services Commission's reviews of personal credit information management and protection.
It also holds security and privacy certifications including ISMS, ISMS-P and ISO 27001.
Shinhan had carried out regular security reviews of loan brokerage firms and had previously identified loan brokerages as high-risk areas when assessing personal data processing subcontractors.
Despite those measures, an attacker was able to bypass authentication on a simplified loan inquiry service and obtain information belonging to about 25,000 customers.
South Korean Banks Face Wider Security Scrutiny
The incidents come after a separate July breach at Woori Bank, where an error by an external development vendor exposed 17,551 pieces of customer information, including nicknames and IDs.
The sequence of incidents has increased scrutiny of security controls across South Korea's financial sector, particularly where banks rely on external vendors, employee platforms and customer-facing services outside their main banking networks.
Authorities are expected to compare the banks' inspection results and examine whether weaknesses in authentication, access controls and external connections could have contributed to repeated data exposures.
Shinhan Bank CEO Jung Sang-hyuk said,
"I deeply apologize for causing concern to our clients and the public over the leak of some customers’ personal and credit information.
We will take full responsibility and fully compensate customers for any losses caused by the leak."
Jung also said the bank would conduct a comprehensive review of its personal credit information protection system and strengthen work processes and employee training.
The investigation comes as Shinhan Financial Group begins CEO succession procedures for subsidiaries whose terms expire at the end of the year.
Jung's term as Shinhan Bank president is due to end on 31 December, while a National Assembly audit is also scheduled.
Anais
Weatherly