Short answer
Starting 1 October 2026, Shinhan, KB Kookmin, Hana, BNK Busan and several smaller Korean financial firms reported intrusions. Yonhap reports that 16 firms leaked about 100,000 records, and police have opened a preliminary investigation.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Shinhan Bank, KB Kookmin Bank, Yegaram Savings Bank and other Korean financial firms |
|---|---|
| Incident type | Data breach |
| Status | Under investigation |
| Sector | Banking and finance |
| Country | South Korea |
| Detected | 2026-09-30 |
| Disclosed | 2026-10-01 |
| People or records affected | About 100,000 records across 16 financial firms, including about 25,000 Shinhan Bank customers and an estimated 40,000 Yegaram Savings Bank customers |
What data was exposed
- Names and phone numbers
- Resident registration numbers, account numbers, addresses and emails (in some cases)
- Income, loan limits and workplace details (in some cases)
What happened
The first public report came on 1 October 2026, when Shinhan Bank’s breach became known. Over the next days other firms disclosed incidents. According to fnnews, Yegaram Savings Bank said an unknown party accessed a customer server on 30 September, with about 40,000 people estimated to be affected. Hyundai Capital reported that data on 146 mortgage loan agents had been exposed from an overseas IP address.
By 28 October, Yonhap reported that hacks at 16 financial firms, including KB Kookmin Bank, had leaked about 100,000 personal records covering resident registration numbers, account numbers and addresses.
The main cases
Figures are as reported and may change. Shinhan Bank: about 25,000 customers. KB Kookmin: 119 customers. Hana Bank: 89 customers. BNK Busan Bank also reported a leak, with no count in our sources. Welcome Savings Bank: up to 2,200 corporate customer records. MTN also noted that some leaks included income, loan limits and workplace details, which suits tailored scam calls.
Late in October the wave reached securities and crypto. Yonhap reported that Daishin Securities leaked data on 38,490 customers. The crypto exchange Bithumb confirmed employee data was taken and is checking member data. Mirae Asset Global Investments said business-system information leaked but no personal credit information so far.
Investigation
Police began a preliminary inquiry on 2 October. They have not ruled out one actor behind the bank cases. The Financial Supervisory Service identified 28 attacker IP addresses across several countries and asked firms to check their logs by 8 October, MTN reported. Whether AI tools were used is unconfirmed.
Staying safe
Korea already has a high rate of voice phishing, and these leaks hand callers real details. Read our guides on urgent payment scams, government impersonation scams and investment scams, then follow the data breach checklist.
What is still unknown
The total number of unique people, the attackers’ identity and whether other insurers or securities firms were accessed are unresolved. MTN said no leak had been confirmed at some insurers and securities firms. See the breaches index and the editorial policy.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Voice phishing calls that quote your loan limit, employer or account details to pose as a bank or the prosecutors' office.
- Smishing about a loan approval, rate cut or account freeze with a link to a fake bank page.
- Loan-broker scams targeting people whose loan inquiry data was exposed.
- Calls offering to 'refinance' or 'recover' funds, a common follow-up to leaked finance data.
What to do if you are affected
- 01Never move money to a 'safe account' on a caller's instruction. Banks and prosecutors do not ask for this.
- 02Hang up on unexpected calls about loans or your accounts and call your bank on the number printed on your card or app.
- 03Check whether your own data was involved: contact your bank, or look for its notice on the app or website.
- 04Report voice phishing to the police on 112 and to the Financial Supervisory Service on 1332. Report suspicious links to KISA on 118.
- 05Consider placing a fraud alert or limiting new credit through your bank if your resident registration number was exposed.
Frequently asked questions
Which banks were hacked in October 2026?
Reports name Shinhan Bank (about 25,000 customers), KB Kookmin Bank (119), Hana Bank (89) and BNK Busan Bank. Savings banks and Hyundai Capital were also hit.
Is my online banking account at risk?
Per MTN, the attackers went after outward-facing systems such as loan-broker inquiry services and staff work tools, not core banking networks.
Were securities firms and crypto exchanges hit too?
Yonhap reports on 28 October that Daishin Securities leaked data on 38,490 customers, Bithumb leaked employee data and is checking member data, and Mirae Asset Global Investments reported business-system information leaked.
Was AI used in the attacks?
Some reports suggest it. Police told fnnews they cannot confirm whether AI was used, though traces of a Chinese-language AI testing tool were found on some suspected attack servers.
Who is investigating?
The National Police Agency's cyber unit opened a preliminary inquiry on 2 October, according to fnnews, and the Financial Supervisory Service shared 28 attacker IP addresses with firms, according to MTN.
Sources
- Bank Breached, Then Savings Banks and Capital Firms Too: Police Probe Financial Sector Hacking (Korean-language article, headline in English), Financial News (fnnews), 2026-10-04
- 파장 커지는 금융권 연쇄 해킹…추가·2차 피해 가능성은? (Spreading financial sector hacks: the chance of more and secondary harm), MTN, 2026-10-06
- Police Launch Preliminary Probe into Hacks at Securities Firms and Crypto Exchanges (Korean-language article, headline in English), Yonhap News, 2026-10-28
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.