Korean banks’ customer data leaked via AI-agent attacks despite top security grades
In short
Customer data was leaked from KB Kookmin, Shinhan and Hana banks after hackers used AI agents to reach auxiliary work-support systems, despite the banks’ touted certifications and hundreds of billions of won in annual security spending. The Financial Supervisory Service said at an emergency meeting that the attacks appeared to be large-scale and automated, and the Financial Services Commission called for building “AI defending against AI attacks”. One outlet reported breach incidents at seven financial companies, while Woori and Nonghyup banks blocked the attacks.
Read the full story 2 min read
Customer information was leaked from KB Kookmin, Shinhan and Hana banks after hackers used AI agents to find and penetrate auxiliary work-support systems, according to reports by Yonhap and the Kyunghyang Shinmun. The breaches bypassed the banks’ main defenses, the two outlets said, citing the banks’ half-year reports and the Financial Supervisory Service. Yonhap reported the compromised routes were Shinhan’s inquiry service for loan recruiters, KB Kookmin’s mobile work-support system for employees and Hana’s sales-support system. [ 1 , 2 ]
In their half-year disclosures for this year, the banks had highlighted their protection capabilities. Shinhan said it received an S grade, or 100 points, for six consecutive years in the Financial Services Commission’s inspection of personal credit information management and protection, and cited ISMS, ISMS-P and ISO27001 certifications, an internal hacking response team and participation in a drill run by NATO’s cyber defence centre, Yonhap reported. KB Kookmin said it applied additional authentication for customer-information access and allowed only authorized employees; Hana said its group security control centre ran 24 hours a day, 365 days a year. [ 1 , 2 ]
Data the FSS submitted to Rep. Lee Yang-soo of the People Power Party showed last year’s information-protection spending reached 53.002 billion won at Hana, 39.297 billion won at KB Kookmin and 31.675 billion won at Shinhan, a combined 123.974 billion won. [ 1 , 2 ]
At an emergency inspection meeting of the financial sector the previous day, the FSS said it suspected large-scale automated attacks using AI agents and listed information inquiries without identity verification, missing access controls and unaddressed known vulnerabilities as the kinds of weaknesses involved. [ 1 , 2 ]
Financial Services Commission Chairman Lee Eok-won said the previous day that however solid a security system is, a single unmanaged gap can become a vulnerability in the entire system, and stressed the need to prepare quickly a system in which “AI defends against AI attacks”. The government is pushing to ease network separation rules and to introduce joint detection and blocking across the financial sector. [ 1 ]
The Kyunghyang Shinmun reported that breach incidents had occurred at seven companies — Shinhan, KB Kookmin, Hana, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital — and that securities, insurance and card firms had been exposed without reporting damage, while Woori Bank and Nonghyup Bank succeeded in blocking the attacks. Yonhap reported that securing the cost and specialist staff to build and run advanced AI defenses is a further task for small and mid-sized financial companies as well as large banks, given the connections between financial firms’ operations and services. [ 1 , 2 ]
Why it matters
The breaches struck three of South Korea’s largest banks, which had presented top grades and domestic and international certifications as evidence of how well they protected customer information, and the FSS said AI-agent attacks may defeat existing defenses. The response now under discussion — looser network separation rules and joint detection and blocking across the financial sector — would change how banks and their regulators handle security, while smaller financial firms face the cost of building AI defenses of their own.
Key facts
- Customer information was leaked from KB Kookmin, Shinhan and Hana banks, with the Financial Supervisory Service saying the attacks appeared to be large-scale and automated. [ 1 , 2 ]
- Yonhap reported the compromised routes were Shinhan’s loan-recruiter inquiry service, KB Kookmin’s mobile work-support system for employees and Hana’s sales-support system. [ 1 ]
- Shinhan said it had received an S grade, or 100 points, for six consecutive years in the Financial Services Commission’s inspection of personal credit information management and protection. [ 1 , 2 ]
- Last year’s information-protection spending was 53.002 billion won at Hana, 39.297 billion won at KB Kookmin and 31.675 billion won at Shinhan, a combined 123.974 billion won, according to FSS data submitted to Rep. Lee Yang-soo. [ 1 , 2 ]
- The FSS held an emergency inspection meeting of the financial sector and cited information inquiries without identity verification, missing access controls and unaddressed known vulnerabilities. [ 1 , 2 ]
- Financial Services Commission Chairman Lee Eok-won called for a system in which “AI defends against AI attacks”. [ 1 ]
- The Kyunghyang Shinmun reported breaches at seven companies and said Woori and Nonghyup banks succeeded in blocking the attacks. [ 2 ]
Confirmed by several sources
- Customer information was leaked from KB Kookmin, Shinhan and Hana banks through hacking attacks the FSS described as likely large-scale and automated. [ 1 , 2 ]
- The three banks had highlighted domestic and international security certifications, top grades and round-the-clock monitoring in their half-year disclosures. [ 1 , 2 ]
- Last year’s information-protection spending was 53.002 billion won at Hana, 39.297 billion won at KB Kookmin and 31.675 billion won at Shinhan, according to FSS data submitted to Rep. Lee Yang-soo. [ 1 , 2 ]
- The FSS held an emergency inspection meeting of the financial sector and listed information inquiries without identity verification, missing access controls and unaddressed known vulnerabilities as weaknesses. [ 1 , 2 ]
Still unclear
- The scale of the leaks and how many customers were affected. Neither document gives a figure for affected customers or for the volume of data taken.
- Whether AI agents were confirmed as the attack method. The FSS estimated large-scale automated attacks using AI agents; the documents do not say the method was confirmed.
- The full list of affected companies. Kyunghyang Shinmun names seven companies, while Yonhap names only three, so the wider list rests on a single outlet.
- When the breaches took place and who carried them out. The documents give no dates for the breaches and do not identify the attackers.
What local media are saying
Timeline, local time
- Yonhap reports that KB Kookmin, Shinhan and Hana banks leaked customer data through auxiliary systems hit by AI-agent hacking, and cites FSS data showing 123.974 billion won in information-protection spending last year. [ 1 ]
- The Kyunghyang Shinmun reports that breach incidents have occurred at seven financial companies, that Woori and Nonghyup banks blocked the attacks, and that securities, insurance and card firms were exposed without reporting damage. [ 2 ]