South Korean authorities confirmed data breaches at 16 financial companies around the time of an incident at Shinhan Bank, spanning banks, savings banks, mutual finance, credit companies, electronic-finance providers, online investment firms and virtual-asset businesses. About 100,000 records were exposed, including names, contact details, resident registration numbers and email addresses. No breaches involving account passwords or card numbers had been identified, authorities said.
The affected companies included Shinhan, Kookmin, Busan and Hana banks, as well as Streami, the operator of Gopax, and virtual-asset platform Prabang. Authorities said the number of affected firms could increase as companies continue checking systems using attack-related internet addresses.
The weaknesses were mostly related to security patches and monitoring systems, with more deficiencies reported among electronic-finance and online investment businesses.
Authorities have instructed affected companies to block attack-related internet addresses, install security patches, suspend services when necessary and notify customers about protective measures. Investigators are examining the attack routes and methods, whether the incidents are connected or involve the same attacker, and whether artificial intelligence was used.
The proposed response includes comprehensive inspections of cybersecurity systems and management controls, faster sharing of threat information among companies and regulators, and more frequent vulnerability testing. Authorities are also considering expanded cybersecurity support for smaller and midsize firms facing AI-related risks, along with stronger responsibility for executives and more effective sanctions when security recommendations are not properly implemented.