South Korea’s financial regulators say the wave of hacks that began early this month has now hit 16 financial firms. The Korea Times noted that is more than double the seven first reported. Personal information from about 100,000 records is presumed to have leaked.
The Financial Services Commission (FSC) set out the figures on 14 October 2026, Yonhap news agency reported. The FSC said affected firms are still checking for further breaches, so the number could rise.
Who was hit
According to the Seoul Economic Daily, five firms newly confirmed breaches on 14 October. They include Streami, which runs the cryptocurrency exchange Gopax, and a second crypto business.
The Korea Times reported that the 16 firms include:
- Banks: Shinhan, KB Kookmin, BNK Busan and Hana.
- Savings banks: Yegaram, Welcome, DB and OK.
- Credit finance companies: Hyundai Capital and KDB Capital.
- Others: online investment firms PFCT and Mouda, payment firm Brightfix, two crypto businesses including Streami, and the Korean Federation of Community Credit Cooperatives.
DB Savings Bank told the Seoul Economic Daily that a hacking attempt was blocked and no customer information leaked.
KDB Capital said it detected an abnormal outside access route on 12 October, and that the names, resident registration numbers and dates of birth of 848 customers leaked, the Seoul Economic Daily reported.
What leaked
Yonhap reported that the leaked data includes emails, names and phone numbers. The Korea Times said resident registration numbers were also exposed. The FSC said bank account numbers and credit card numbers were not leaked, according to Yonhap.
Was AI used?
Regulators have not confirmed that AI was used. The Korea Times described the attacks as “suspected” AI agent-driven cyberattacks, and said regulators are investigating whether one hacking group was behind them.
Tighter checks
The Seoul Economic Daily reported that financial firms currently must run vulnerability checks once a year. Regulators plan to raise this to “at least twice a year”, starting with large firms that have many customers.
A review of 555 financial firms up to 8 October found that 130, or 23.4%, reported security shortcomings, such as missing security patches and old systems no longer supported by their makers.
FSC Secretary General Shin Jin-chang chaired the 14 October meeting. “It is deeply troubling that financial firms are still failing to meet basic security requirements despite repeated calls for comprehensive inspections and stronger controls,” he said, according to The Korea Times.
What this means
- The damage is still being counted. The FSC expects more breaches may be found.
- Crypto firms are now affected too. The hacks have spread from banks to a crypto exchange operator.
- Security checks are tightening. Large firms face more frequent checks, and regulators have exposed widespread basic security gaps.
Sources
- Yonhap, “Personal info presumed to have leaked from 16 financial institutions: regulator”, 14 October 2026. https://en.yna.co.kr/view/AEN20261014006900320
- Seoul Economic Daily, “16 Financial Firms, Including Crypto Exchange Gopax, Hit by Data Leaks in AI-Driven Hacking Wave”, 14 October 2026. https://en.sedaily.com/finance/2026/10/14/crypto-exchange-gopax-hacked-as-100000-records-leak-at-16
- The Korea Times, “AI-driven cyberattacks hit 16 financial firms, expose 100,000 records”, 14 October 2026. https://www.koreatimes.co.kr/business/banking-finance/20261014/ai-driven-cyberattacks-hit-16-financial-firms-expose-100000-records
