Analysis
The count more than doubled in about a week, and the list now reaches beyond banks to savings banks, card and lending companies, online investment firms, crypto businesses and a cooperative federation. The regulator's own inspection findings, with nearly a quarter of reviewed firms showing security gaps, shift the focus from the attacker's tools to basic upkeep such as software updates and round-the-clock monitoring.
What changed
In early October, South Korean banks began disclosing data breaches, and on October 7 the security firm CrowdStrike tied attacks on the country's financial organizations to an AI hacking agent. This week the Financial Services Commission, the country's financial regulator, gave a wider count. At an emergency response meeting chaired by its Secretary General, Shin Jin-chang, officials said 16 financial firms have been affected, more than double the seven first reported [1][2].
About 100,000 records were exposed, according to the Korea Times. They include names, contact details and resident registration numbers, the national identification numbers South Koreans use across financial and government services. The Chosun Ilbo, citing a financial authorities source, also lists email addresses. The same source said no directly usable information such as account or card numbers has been found in the leaked data [1][2]. The count could rise as companies check their systems [1].
Who is on the list
Shinhan Bank and KB Kookmin Bank are among four banks on the list, alongside two other banks. The rest are four savings banks, two credit finance companies, two online investment-linked lending firms, an electronic financial services provider, two crypto businesses and a national federation of community credit cooperatives [1][2].
The Chosun Ilbo reported that five of the 16, including a savings bank, a credit finance company and both crypto businesses, were newly identified in this disclosure [2]. The breaches now span every part of the financial sector the regulator oversees, from banks to crypto firms [2].
What the inspections found
Regulators said 130 of the 555 financial firms inspected across 12 areas through October 8, or 23.4%, had security deficiencies. Common problems included missing security updates, weak oversight of systems the manufacturer no longer supports, no 24-hour security monitoring, and gaps in how external systems are authenticated and authorized. The gaps were relatively widespread among electronic financial services providers and online investment-linked finance companies [1].
Shin said it is deeply troubling that financial firms are still failing to meet basic security requirements [1]. The regulator is checking whether the attacks were carried out by the same hacking group, and the Korea Times reports it plans a broader review of sector security practices, including greater accountability for chief executives and boards [1]. Chosun Ilbo reports the plans include raising vulnerability checks at large financial institutions from once to at least twice a year and creating a system to share hacking threat information across the sector [2].
What remains uncertain
The 16-firm and 100,000-record figures are regulator disclosures as reported by the Korea Times and the Chosun Ilbo, and both outlets say the numbers may rise as companies continue to investigate. Whether one group is behind all the intrusions has not been established, and the regulator's description of the attacks as suspected AI-agent-driven is not a finding against any named attacker. The FSC's own statement was not reviewed. Being on the list does not mean a firm's customers were all affected, and no loss of customer funds was reported in the cited coverage.