OK Savings Bank finds second hack, raising number of customers with leaked data to 518
In short
OK Savings Bank (OK저축은행) said on 16 October that data on 268 more customers had leaked through a page for its mobile deposit service, bringing the total to 518. The attack ran from 03:32 to 07:34 on 15 October and exposed names, account numbers, product names, balances, interest rates and last transaction dates. It follows an attack on the bank's loan application web page that leaked data on 250 customers.
Read the full story 2 min read
OK Savings Bank said on 16 October that it had confirmed a further leak of customer data, adding 268 customers to the 250 it had disclosed the previous day, for a total of 518. The company said the additional leak was found during a detailed inspection of its systems, including deposit and banking services, after the first incident. [ 5 , 6 , 8 ]
According to the company, there were abnormal access attempts on a page related to its mobile deposit service from 03:32 to 07:34 on 15 October, about four hours. The leaked items were names, account numbers, product names, balances, interest rates and last transaction dates. Kukmin Ilbo wrote that the attack exposed actual financial details, not only basic personal information. [ 3 , 5 , 6 , 7 , 11 ]
Yonhap and Kukmin Ilbo reported that the company believes the IP address used in the second attack differs from suspected hacking IPs the Financial Security Institute had shared in advance. Kyunghyang Shinmun reported the company said the address was different from those that had previously breached the financial sector, and that its country had not been identified. The bank said it had blocked the suspected IP, patched the defence logic of its account inquiry service and urgently applied anomaly detection and blocking tools, and that there had been no new abnormal access. It reported the leak to the Financial Supervisory Service, Yonhap and Kukmin Ilbo said. [ 3 , 6 , 7 , 10 , 11 ]
In the first incident, the attack on the loan application web page ran from 20:44 on 11 October to 02:14 on 12 October. The bank noticed the abnormal access around 10:00 on 12 October and reported the possible leak to the Financial Supervisory Service on 13 October. Seoul Economic Daily reported that an investigation by two outside security firms confirmed data on 250 loan applicants had leaked, including names, birth dates, mobile numbers, account numbers, addresses, email addresses, workplace names, business registration numbers, annual income and loan amounts. [ 1 , 2 ]
The bank notified affected customers by text message and email, and Korea Economic Daily said it advised them to use a financial transaction safe-block service. The company said it would provide guidance to prevent further harm and run a counselling desk. A company official said the additional leak was found while re-checking the whole system and apologised again to customers for causing concern. [ 1 , 2 , 3 , 5 , 6 , 7 , 10 ]
Outlets differ on when the first leak was announced: Seoul Economic Daily and Korea Economic Daily reported it on 15 October, while Yonhap, Kukmin Ilbo and Chosun Ilbo wrote that the bank had announced it on 12 October. Chosun Ilbo said the second leak came four days after that announcement; Kukmin Ilbo said one day. [ 1 , 2 , 3 , 7 , 11 ]
Why it matters
The second leak included account balances and interest rates, which Kukmin Ilbo said went beyond basic personal details to actual financial information. The bank has reported the incidents to the Financial Supervisory Service and says it is re-checking its security systems.
Key facts
- Data on 268 customers of OK Savings Bank's mobile deposit service leaked in a second attack, bringing the total to 518. [ 3 , 5 , 6 , 8 ]
- The second attack took place from 03:32 to 07:34 on 15 October. [ 5 , 6 ]
- Leaked items in the second attack: name, account number, product name, balance, interest rate and last transaction date. [ 3 , 5 , 6 , 7 , 10 , 11 ]
- The first attack, on the loan application web page, ran from 20:44 on 11 October to 02:14 on 12 October and leaked data on 250 customers. [ 1 , 2 ]
- The first leak included names, birth dates, mobile numbers, account numbers, addresses, annual income and loan amounts. [ 1 , 2 ]
- The company believes the IP address used in the second attack differs from suspected hacking IPs shared in advance by the Financial Security Institute. [ 3 , 7 ]
- Affected customers were notified individually by text message and email. [ 1 , 2 , 3 , 5 , 6 , 7 , 10 ]
Confirmed by several sources
- Data on 268 additional customers leaked through a page related to the mobile deposit service. [ 3 , 5 , 6 , 7 , 10 , 11 ]
- The total number of affected customers rose to 518. [ 3 , 5 , 6 , 8 ]
- The second attack began at 03:32 on 15 October and lasted about four hours. [ 3 , 5 , 6 , 7 , 9 , 11 ]
- The second leak covered names, account numbers, product names, balances, interest rates and last transaction dates. [ 3 , 5 , 6 , 7 , 10 , 11 ]
- The first attack leaked data on 250 customers through the loan application web page. [ 1 , 2 , 3 , 7 , 10 , 11 ]
- The first attack ran from 20:44 on 11 October to 02:14 on 12 October; the bank noticed the abnormal access around 10:00 on 12 October and reported it to the Financial Supervisory Service on 13 October. [ 1 , 2 ]
- The IP address used in the second attack differs from suspected hacking IPs the Financial Security Institute had shared in advance, according to the company. [ 3 , 7 ]
- The company said it blocked the suspected IP, patched the defence logic of its account inquiry service and urgently applied anomaly detection and blocking tools, and that there has been no new abnormal access. [ 3 , 6 , 7 , 11 ]
Still unclear
- When the first leak was announced. Seoul Economic Daily and Korea Economic Daily reported the 250-customer leak was announced on 15 October, while Yonhap, Kukmin Ilbo and Chosun Ilbo wrote it was announced on 12 October; Chosun Ilbo said the second leak came four days after that announcement, Kukmin Ilbo said one day.
- Where the attacking IP address is located. Kyunghyang Shinmun reported the company said the country of the address had not been identified.
- Exact length of the first attack. Seoul Economic Daily put it at about five and a half hours and Korea Economic Daily at about five hours, though both give the same start and end times.
What local media are saying
Timeline, local time
- 11 October: attack on the loan application web page begins. [ 1 , 2 ]
- 12 October: first attack ends. [ 1 , 2 ]
- 12 October: the bank notices abnormal access and blocks the suspected IP and access routes. [ 1 , 2 ]
- 15 October: attack on a mobile deposit service page begins. [ 3 , 5 , 6 , 7 , 9 , 11 ]
- 15 October: second attack ends. [ 5 , 6 ]
- 15 October: Seoul Economic Daily reports the bank has confirmed data on 250 customers leaked. [ 1 ]
- 16 October: Newsis reports the bank's confirmation of 268 more affected customers, 518 in total. [ 6 ]