Another Wave of Hacks Hits South Korea's Financial Companies

Daishin Securities said on October 28, 2026 that a cyberattack had exposed the personal information of 38,490 customers. The same day, Mirae Asset Global Investments and the crypto exchange Bithumb each reported separate cybersecurity incidents. Neither confirmed that customer data had been taken. The three reports form a fresh wave of attacks on South Korea's financial industry, according to TechCrunch.

What was exposed

The Daishin breach exposed customer names, email addresses and mobile phone numbers. The data did not include passwords or account numbers, so criminals cannot log into accounts with it directly.

The main risk is trickery. Criminals can use these details to send convincing fake messages, a tactic called phishing. They can also attempt SIM-swap fraud, which means persuading a phone company to move your number onto a SIM card the criminal controls.

Officials were still looking for the root cause of the October 28 breaches as of that date.

The regulator responds

The Financial Services Commission, South Korea's financial regulator, called for stronger cybersecurity. The call followed attacks on financial firms and government agencies. The regulator also planned security checks on dozens of private-sector IT systems. Those checks are still a plan. Their scope and timetable had not been finished.

How the wave started

The current wave follows a series of incidents that began in late September 2026. Security researchers linked the September attacks to a suspected China-based hacker. The hacker used Artex, an AI-based penetration testing tool. Such tools check computer systems for weak spots, but attackers can use them too.

The Straits Times reported in early October that suspicion had fallen on one attacker using AI to breach financial firms. By then, attacks had exposed personal data at seven firms.

The count keeps rising

On October 4, President Lee Jae Myung ordered a probe into data leaks across the financial industry. An emergency meeting first set for October 7 was moved up. Additional breaches had been found at second-tier financial institutions. The next day, Lee said AI appeared to have been used in the bank hacks. Police were investigating breaches at several major lenders at that time.

As of October 14, South Korea had found hacking incidents at 16 financial firms. Around 100,000 cases of customer data exposure had been identified across the sector, according to Reuters. That same day, the Financial Services Commission met with officials from related organizations. The goal was to strengthen defenses against hackers in finance.

Earlier breaches

South Korea has seen this kind of exposure before. Lotte Card, which issues credit and debit cards, was breached between July 22 and August 2025. In April 2025, telecom operator SK Telecom suffered a cyberattack that led to the theft of personal data.

What the stolen details enable

Names, email addresses and phone numbers are not very valuable on their own. Put together across 16 firms and about 100,000 exposure cases, they become a useful set of puzzle pieces for targeted phishing and impersonation. The risk grows where the same details are used in one-time passwords, the codes sent to your phone to confirm it is you, and in account recovery.

The reporting says the campaign used tools that automate the search for weaknesses and the attack itself. That lowers the skill and time needed for each target. Whether the root cause of the October 28 incidents matches the September pattern is not yet established.

In my view, the bigger question for the sector is whether security checks can keep up with an attacker who can probe many firms at once. Regulators can order audits quickly. Confirming that audited systems are truly hardened, and that customer details cannot be reused to pass logins, takes longer. How fast the commission turns its plans into checks that can be verified will help decide whether the exposure stops at the current count.

Other financial reforms

The same day, the commission held its seventh meeting on moving toward inclusive finance, which aims to bring financial services to more people. Officials and private-sector experts took part.

Officials discussed a new evaluation system for financial companies. Seventeen domestic banks would be split into three groups: large banks, small and medium-sized banks, and internet-only banks. Each bank would be judged against others in its group. The Financial Supervisory Service will oversee the process. A committee led by a private-sector appointee will make the final decisions. Companies would be assessed each year on the previous year's results, with the outcome announced in March. The system will extend to non-banking companies from next year.

Officials also discussed ways to better manage non-performing loans at public financial institutions. These are loans that borrowers have stopped repaying.

Interest-rate reform

On October 26, the commission reported progress on benchmark rate reform, a plan first announced in March. A benchmark rate is a reference interest rate that many loans and contracts are based on.

KOFR-OIS transactions, a type of interest-rate contract, exceeded the 10 percent goal for the first year, from July 2025 to June 2026. They reached 12.1 percent. In the third quarter of 2026, they stood at around 18.5 percent. The target for the second year, from July 2026 to June 2027, is 25 percent. The longer-term goal is 70 percent or more by June 2030.

The rate reform and the inclusive finance evaluation are separate projects. Both, however, now sit with a regulator whose urgent priority is the breach wave.