Several major South Korean banks and financial institutions have experienced cyber intrusions in recent days that led to the exposure of personal data. President Li Dzsemjong ordered a comprehensive investigation and response measures on Sunday, according to an announcement from the presidential office.
Regulatory action and emergency meeting
Li Okvon, chair of the Financial Services Commission (FSC), convened an emergency meeting on the same day with leaders of affected institutions, industry groups and supervisory agencies, and declared the highest level of vigilance for the financial sector. A crisis meeting originally scheduled for October 7 was brought forward after additional incidents were discovered at smaller financial firms.
Timeline and affected institutions
The FSC said authorities launched on-site inspections on September 30 after Sinhan Bank reported a system intrusion; the investigation has since been expanded to other affected institutions. According to the Yonhap news agency, Sinhan Bank and KB Kukmin Bank were joined by Hana Bank and Uri Bank among those that suffered data leaks.
Possible use of AI and directed measures
FSC leadership said the involvement of attackers using artificial intelligence (AI) could not be ruled out, and urged adoption of AI-based defensive approaches as well as a comprehensive upgrade of the financial sector's cybersecurity framework.
Regulators instructed financial institutions to take several immediate steps:
- conduct full security audits,
- tighten access privileges,
- limit external system connections,
- strengthen customer protection measures.
Attack characteristics and information sharing
Authorities believe the attacks did not target a single institution but rather sought vulnerable points across a range of financial companies. Data submitted by banks to lawmakers indicated attacker traffic came from IP addresses in the United States, Japan, Singapore, Vietnam and the United Kingdom. The FSC said it will promptly share attack methods, IP addresses and related threat intelligence across the sector to help prevent further incidents.
Political response
The main opposition People Power Party called on authorities to investigate a possible North Korean link, citing past cyberattacks by Pyongyang against South Korean financial institutions.
Why this matters
A series of data breaches affecting multiple institutions poses significant risks to customers' personal information and the resilience of the financial system. The incidents have highlighted sector vulnerabilities and prompted regulatory demands for urgent, coordinated defensive actions and rapid sharing of threat information.
An AI assistant contributed to the preparation of this article; the final content was edited and verified by our journalist.
