iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
At least seven South Korean financial institutions reported customer-data breaches in late September and early October 2026. South Korean officials suspect AI may have been involved in some attacks, but that remains unconfirmed: the evidence reported so far does not establish that AI autonomously carried them out or identify who was responsible.
What happened?
Reports describe breaches affecting four commercial banks—Shinhan Bank, KB Kookmin Bank, Hana Bank and BNK Busan Bank—along with savings banks Yegaram and Welcome, and Hyundai Capital, a capital company. The incidents were disclosed over roughly the last week of September through 6 October 2026. Reported victim totals differ by source and should not be treated as a settled sector-wide count.
The reports identify personal and loan-application information, including names, phone numbers and income data. There is no confirmed evidence in the cited reporting that payment credentials were stolen. The exposed details can nevertheless help criminals make phishing messages or calls more convincing.
Which institutions and customer figures have been reported?
The figures below are institution-specific claims reported in 2026 coverage; they do not add up to a reliable total because sources use different counts and scopes.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Institution | Reported impact | Reported data or qualification |
|---|---|---|
| Shinhan Bank | About 25,000 customers | Loan-application data including names, phone numbers and annual income, as reported by AFP via Malay Mail. |
| KB Kookmin Bank | 99 customers and 20 current or former employees | Reported by American Banker. Another report gives 119 customers, so the customer count is not consistent across coverage. |
| Hana Bank | 89 customers | Reported by American Banker. |
For the broader set of breaches, AFP reporting carried by Malay Mail said data belonging to more than 68,000 people had been exposed; TechTimes reported more than 65,000 records. These are different reported estimates, not a confirmed final total.
Were South Korean banks hacked by AI?
AI use is suspected, not established. On 6 October, President Lee Jae Myung said signs had emerged that AI was used in some hacking incidents. Coverage of the Cabinet meeting reported his remarks; they should not be read as a technical finding about every breach.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Earlier reporting by Bloomberg, citing Yonhap, and The Star said cybersecurity experts believed sophisticated AI agents may have been used to probe for vulnerabilities before unauthorized access to a service used by loan recruiters. A Chinese-language string found in infrastructure believed linked to the intrusion was translated as “AI autonomous penetration testing console” and associated with ARTEX AI, an open-source, LLM-based penetration-testing framework. That string does not prove the framework was used, or that an AI system operated autonomously.
Recommended Free Tools
An unnamed government official told AFP it was “highly likely” that ARTEX AI had been used, as reported by Malay Mail. This is an attributed assessment, not public confirmation. The tool is publicly available, and officials have cautioned that the use of a Chinese-origin tool does not establish that the attackers were Chinese.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How were the institutions reportedly accessed?
The Financial Services Commission, as reported by American Banker, pointed to systems used by employees and outside personnel, including contractors and loan recruiters—not customer-facing internet or mobile banking services. Coverage described a Shinhan lookup service built for loan recruiters, a mobile work-support system for employees at another bank, and a sales-support system at a third institution.
This distinction matters: the reported incidents concern access paths associated with work and sales operations. The available reporting does not say that customers’ banking apps or public online-banking portals were the entry point.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Who is responsible, and what is known about attribution?
Attribution remains unresolved. The Financial Supervisory Service and Financial Security Institute reportedly shared 28 unique IP addresses with the financial sector, but an IP address alone cannot identify an attacker. The addresses appeared across multiple countries, which further limits what can responsibly be inferred from their locations.
On 6 October, police announced a formal investigation. The Korean National Police Agency assigned 28 investigators from its cyberterrorism unit across four teams, according to American Banker. The investigation may clarify the method and scope; the information publicly reported so far does not name a perpetrator.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What are regulators and banks doing?
South Korea’s Financial Services Commission and Financial Supervisory Service called for comprehensive internal reviews and stronger security measures across the sector. Regulators also asked firms to complete checks of internet-facing systems and address gaps by “Thursday.” The reports available here point to approximately 8 October 2026, but do not establish the exact deadline date.
What should affected customers do?
Because the reported exposed information includes contact and income details, watch for messages or calls that refer to a loan application, bank employee or personal financial details. Treat an unexpected request for a password, one-time verification code, card number or transfer as suspicious. Verify it by contacting the institution through a phone number or app you already trust, rather than using a link or number supplied in the message.
Quick Recap
- Do not share passwords, one-time codes or card details in response to an unsolicited call or message.
- Use your bank’s official app or independently verified contact channel to check whether a request is genuine.
- Be especially cautious of targeted messages that use your name, phone number or income context; accurate personal details do not prove the sender is legitimate.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
