South Korea’s financial sector has a security problem that reaches far beyond its banks, with regulators now confirming breaches at 16 institutions and roughly 100,000 leaked personal records.
The Financial Services Commission (FSC) disclosed the expanded scope on Oct. 14 following a second emergency response meeting with financial regulators and government agencies.
The investigation remains ongoing, with authorities warning that more institutions could be affected as they examine their systems for signs of compromise.
The affected institutions include four banks, four savings banks, two specialized finance companies, two online investment-linked finance platforms, an electronic financial services provider, two virtual asset operators and a cooperative finance institution, according to South Korean media reports.
Five newly identified victims are DB Savings Bank, KDB Capital, Brightfix, Streami and Prabang. Streami operates the Gopax cryptocurrency exchange, while Prabang also provides crypto trading services.
The FSC estimates that about 100,000 records have been exposed, including names, phone numbers, resident registration numbers and email addresses. Authorities have not identified leaked bank account or payment card numbers among the compromised information.
AI involvement remains under investigation
South Korean authorities are investigating how the attackers gained access and whether artificial intelligence played a role. The FSC has also announced plans for security inspections, earlier threat detection and coordinated incident response.
The breaches have exposed weaknesses beyond individual companies. A security review of 555 financial institutions found 130 reported deficiencies, including outdated software, unsupported systems, and inadequate round-the-clock monitoring, according to Seoul Economic Daily.
Regulators plan to strengthen vulnerability checks, improve information sharing and clarify the security responsibilities of executives and technology leaders. They are also considering AI-assisted monitoring to help smaller financial firms identify exposed systems and respond to threats.
Why the security gaps matter
The findings suggest the sector's defenses may not keep pace with the number of systems and services connected to external networks. Even when attackers cannot access payment credentials, stolen identity details can remain useful for targeted phishing, impersonation and attempts to take over customer accounts.
The fact that affected institutions span traditional banking, lending, payments and cryptocurrency services also complicates incident response. Customers may use several of these services, meaning a single set of leaked personal details could help criminals make convincing approaches across multiple platforms.
The investigation has not established whether the same attackers targeted all 16 institutions or whether the incidents share a common vulnerability.
What customers should do now
Customers of South Korean financial institutions should watch for unexpected messages, calls or emails that use their real names or other personal details. They should avoid clicking unfamiliar links, sharing verification codes or providing passwords in response to unsolicited requests.
Where available, customers should enable multifactor authentication, use unique passwords and review account activity for unfamiliar transactions or login attempts. Anyone who suspects their information was exposed should contact their financial provider through its official website or app.
While authorities have not identified compromised payment card or bank account numbers, the exposed identity information still presents potential fraud risks.
The investigation remains open, and regulators have warned that additional institutions could be identified as financial firms continue reviewing their systems for signs of compromise.
Other news: Drone strikes reportedly disrupted a Yandex data center, triggering a service outage and highlighting the physical security risks facing critical digital infrastructure.