South Korea’s Financial Supervisory Service said Tuesday it had identified twenty-eight distinct internet protocol addresses linked to a wave of intrusions at major lenders and gave affected institutions until Thursday to finish internal checks and close the gaps that allowed customer records to spill into the open.
The order lands in the middle of a broader government scramble after Shinhan Bank disclosed on 1 October that data belonging to roughly twenty-five thousand customers had leaked, followed within days by similar admissions from KB Kookmin, Hana, BNK Busan, Yegaram and Welcome savings banks and Hyundai Capital. Combined exposure reported so far reaches about sixty-six thousand individuals and twenty-two hundred corporate records, according to figures compiled by the Korea Herald and Korea Times from company statements.
What regulators told the banks
The FSS said it shared the traced addresses with the seven institutions that have confirmed breaches and asked each to verify whether additional systems were touched. Regulators framed the deadline as an emergency hygiene step rather than a final accounting of liability, but the short fuse underscores how little patience Seoul has after back-to-back disclosures that hit some of the country’s largest retail franchises.
Prime Minister Han Seong-sook told a cabinet meeting Tuesday that recent attacks show existing information-security frameworks are “no longer effective” against rapidly changing threats. President Lee Jae Myung, speaking at the same session, called for a swift and thorough police response, reflecting political pressure that already forced the education minister’s resignation earlier this year after exam-paper leaks.
Police scale-up
The National Police Agency assigned twenty-eight investigators across four teams from its cybercrime response unit to the case, a deployment the agency described as a coordinated inquiry into hacking attempts. Officers are reviewing whether the incidents must be escalated to the newly established Serious Crimes Investigation Agency, a step that would signal how seriously prosecutors view the intrusions.
Security researchers told local broadcasters the incidents may have involved automated tools that use artificial intelligence to probe for software flaws, though attributions remain preliminary. Woori Bank and NH NongHyup Bank also reported similar attack attempts, but neither has confirmed data exfiltration, leaving open the possibility that more disclosures could arrive before the FSS deadline passes.
Beyond the vault
Han warned that AI-assisted phishing could produce secondary harm if leaked phone numbers and account metadata feed convincing impersonation schemes. She ordered financial authorities to ensure affected lenders implement customer protection measures and compensation plans, a reminder that regulatory fines may be the smaller line item compared with reputational damage at institutions that compete aggressively on mobile banking.
For Korean households, the bulletin is less about any single IP address than about a synchronized stress test of a sector that markets itself on biometric logins and instant transfers. If the Thursday fixes satisfy supervisors, attention will shift to whether parliament accelerates cybersecurity legislation—and whether the same intrusion patterns appear in government or industrial systems Han said could be next in line.