South Korea’s president has ordered a government-wide investigation into a cluster of data breaches at banks and other financial institutions, widening a regulatory response that began with individual reports of unauthorized access.
President Lee Jae Myung directed authorities on Sunday to establish how the breaches occurred and to prepare measures addressing the broader weakness they may expose. The order followed reports involving major commercial banks as well as savings banks and specialized credit-finance companies.
The Financial Services Commission brought regulators, industry associations and executives from affected institutions into an emergency meeting the same day. Its chairman, Lee Eog-weon, told the sector to operate at its highest level of vigilance while on-site inspections continue.
Shinhan Bank reported on September 30 that personal data relating to about 25,000 customers had been exposed. Information associated with 89 Hana Bank customers was also reported compromised. Other institutions detected attacks but said their controls prevented personal data from being taken.
Regulators said the information identified so far does not appear to include the credentials needed to make unauthorized payments. That does not remove the consumer risk: names, telephone numbers and financial details can be assembled into convincing voice-phishing and impersonation attempts.
The commission has instructed financial firms to conduct comprehensive security checks, tighten access controls, reduce unnecessary connections to external systems and strengthen safeguards for customers. Attack methods, internet addresses and other threat intelligence are to be shared quickly across the sector.
Officials have not identified the perpetrators. The regulator has not ruled out the use of artificial-intelligence tools, but that remains an investigative possibility rather than a finding. The opposition has separately called for scrutiny of possible North Korean involvement; authorities have not publicly endorsed that theory.
The inquiry now has two tasks: tracing the separate intrusions and deciding whether their concentration reveals a common vulnerability. Its conclusions could shape both enforcement against individual institutions and the next revision of South Korea’s financial cybersecurity rules.
