Global: South Korea orders investigation as cyberattacks expose bank customer data

South Korean President Lee Jae Myung has ordered a full investigation into a series of data breaches targeting banks and financial services firms, as authorities assess the possibility of a coordinated cyberattack.

Seven financial institutions, including Hana Bank, Woori Bank, Shinhan Bank and Yegaram Savings Bank, have been hit in a recent wave of attacks that exposed the personal information of thousands of customers.

Authorities investigate possible coordinated attack

According to local media reports, authorities identified the same internet protocol address across the affected financial institutions, raising concerns that the incidents could be connected and potentially involve an AI-powered campaign.

The pattern has heightened scrutiny of cybersecurity controls across South Korea’s financial sector, particularly as financial institutions face increasingly sophisticated threats targeting customer data and digital infrastructure.

Lee Eok-won, chairman of the Financial Services Commission (FSC), said authorities could not rule out the possibility that artificial intelligence was involved in the attacks.

“We cannot rule out the possibility of attacks using AI,” Lee said.

The FSC subsequently convened an emergency meeting with financial companies on Friday and instructed them to conduct comprehensive checks of their cybersecurity systems and defences.

Financial institutions face stronger cybersecurity scrutiny

The incidents highlight the growing importance of effective cybersecurity, data governance and risk assessment frameworks within financial institutions as digital banking services expand.

A coordinated attack involving multiple institutions could also expose weaknesses in shared infrastructure, third-party systems or other interconnected components of the financial ecosystem, increasing the need for continuous regulatory monitoring and security controls.

President demands urgent response

President Lee was briefed on the breaches and has directed officials to establish the full scope of the incidents and develop measures to prevent further attacks.

A presidential spokesperson said the president had ordered officials to “conduct a thorough investigation and make every effort to devise measures, with a grave awareness of the seriousness of the matter.”

The investigation is expected to determine how the breaches occurred, whether the incidents are connected and whether additional measures are required to strengthen cybersecurity and protect customer data across South Korea’s financial sector.