SEOUL — South Korea’s Shinhan Bank is facing an urgent regulatory investigation after a data breach exposed personal and credit information connected to approximately 25,000 customers, including sensitive details submitted during loan applications.
The bank disclosed the incident on Oct. 1, apologizing to customers and promising to fully compensate those who suffer losses as a result of the breach. The Financial Supervisory Service (FSS) immediately launched an on-site inspection to determine how the information was accessed and the precise scope of the leak.
What Customer Information Was Exposed?
According to Shinhan Bank, the leaked information included customers’ names, phone numbers, annual income and calculated loan limits, along with other information associated with loan applications.
The bank also confirmed that the breach involved 66 cases containing resident registration numbers and 97 cases involving connecting information (CI), an identifier used in online identity verification.
The exposure of income and loan-related information has heightened concerns because the affected records contain financial information beyond basic contact details.
Authorities are still determining whether additional information was accessed and whether any of the leaked data has been misused.
How Did the Breach Happen?
Shinhan Bank said an unauthorized external party accessed some of its services through an abnormal method that bypassed normal authentication procedures.
The affected system was connected to services used by loan brokers, who could access information relating to loan applications.
Some Korean media reports have raised the possibility of a credential-stuffing attack, in which previously obtained usernames and passwords are repeatedly tested against another service. However, the exact intrusion method remains under investigation and has not been conclusively established by regulators.
Importantly, reports indicate that the incident did not involve the ordinary customer banking services that require the standard login authentication process.
Shinhan Bank Moves to Contain the Damage
Shinhan said it activated an emergency response system after detecting the incident.
The bank said it blocked external IP addresses, suspended the affected service and introduced additional security measures to prevent further unauthorized access. It also said it would conduct a comprehensive review of its personal-information protection systems.
Shinhan Bank President and CEO Jung Sang-hyuk publicly apologized and said the bank would take responsibility for losses suffered by customers as a result of the incident.
The bank has also established a dedicated customer-support channel and a way for customers to check whether their information was among the leaked records.
Financial Regulators Step In
The Financial Supervisory Service began an emergency on-site inspection after receiving Shinhan Bank’s report.
Investigators are examining how the unauthorized access occurred, the intrusion route, the categories of information exposed and the overall scale of the breach.
The Financial Services Commission and FSS also held an emergency meeting to discuss the incident and possible follow-up measures.
The investigation could take time as authorities work to establish exactly what happened and whether further customer information was compromised.
A Growing Concern for South Korea’s Financial Sector
The Shinhan Bank incident comes amid heightened scrutiny of cybersecurity and personal-data protection in South Korea.
For financial institutions, the incident illustrates why systems handling loan applications and credit information require strong access controls even when they are separate from customers’ ordinary online-banking services.
For the approximately 25,000 affected customers, the immediate issue is whether their information was exposed and whether it could be misused.
Shinhan has pledged full compensation for losses caused by the breach, while regulators continue investigating the incident.
The central unanswered question now is not simply how many records were exposed, but how an unauthorized party was able to reach sensitive loan-related information in the first place — an issue the financial authorities are expected to examine closely as the investigation continues.
WWC ONE MEDIA G,A
