On 14 October 2026, South Korea's Financial Services Commission (FSC) held a cybersecurity meeting and said 16 financial companies had confirmed recent data breaches, with an estimated 100,000 customer records affected. The first public step was an emergency meeting on 2 October, after a customer information leak at Shinhan Bank on 30 September.
This post separates what the regulator has stated, what the press has added, and what nobody has said yet.
What is confirmed
These points come from the FSC's own releases.
- On 2 October 2026 the FSC held an emergency response meeting with the Financial Supervisory Service, the Financial Security Institute, six banks, three card companies and industry associations. The release says Shinhan Bank had a customer information leak on 30 September and that cyberattacks then hit other major firms, including KB Kookmin Bank.
- The 2 October directives told firms to inspect every externally exposed IT system, minimize unnecessary external exposure of information, check for access paths to internal data that lack authentication (especially customer data lookups), and share attacker IP addresses and methods quickly.
- The 14 October release says 16 companies are confirmed to have had data breaches across financial sectors, affecting about 100,000 customer records.
- Exposed data types named in the release: names, contact information, resident registration numbers and email addresses. No breaches of account passwords or credit card numbers have been reported.
- 555 companies completed a 12 point self-assessment checklist. 425 rated their measures adequate and 130 identified areas needing improvement, mainly security patching and control systems.
- Affected firms must block the attack-linked IP addresses, apply patches and consider suspending services.
What is reported
- The Korea Times reported on 14 October that the 16 firms are more than double the seven first reported, and that the FSC cited the figure of 130 of 555 firms (23.4%) as having deficiencies.
- The same article lists affected firms by sector, including Shinhan, KB Kookmin, BNK Busan and Hana among banks, two crypto businesses and a payments firm. The FSC release does not name companies, so treat the list as press reporting.
- The Korea Times describes the attacks as suspected to be AI agent driven. The FSC release says only that investigators are checking whether AI was used.
- Press coverage quotes the FSC Secretary General as saying it is "deeply troubling that financial firms are still failing to meet basic security requirements."
What is not known
- How the attackers got in at any given firm. The release gives no technique.
- Whether one group is behind all 16 cases. The FSC says it is checking.
- Whether AI played any role.
- The final record count. The figure is an estimate and the FSC said firms are still checking.
What to do now
- If you run a financial or fintech service, list every internet facing system and every customer lookup endpoint, and confirm each one requires authentication.
- Block shared attacker IP addresses when your regulator or sector group publishes them, and keep the list in a place your network team can update quickly.
- Patch exposed systems first and retire anything no longer supported.
- If you are a customer of an affected firm, expect phishing that uses your name and resident registration number. Do not act on unsolicited messages.
How this could have been avoided
The cause has not been published, so this is limited to what the regulator itself flagged.
- Authentication on every customer data lookup. The FSC specifically asked firms to check for paths to internal data without it.
- A current inventory of externally exposed assets, so no system sits unwatched.
- Timely patching and removal of unsupported systems, the top gaps in the self-assessment.
- Round the clock monitoring, listed by the Korea Times as a common gap.
- Rapid sharing of attacker IP addresses between firms so the second victim benefits from the first.
Try it yourself
Build an inventory of internet facing assets before an incident forces you to.
Click through it at your own pace, or open it full screen.
Quick check
Is it confirmed that AI agents carried out these attacks?
No. The FSC release says investigators are checking whether AI was used. The AI agent description comes from press reporting.
Which data types did the regulator say were exposed?
Names, contact information, resident registration numbers and email addresses. No account passwords or card numbers have been reported.
