South Korea's Financial Sector Faces a Fresh Wave of Cyberattacks
On October 28, 2026, Daishin Securities reported that a cyberattack had exposed the personal information of 38,490 customers. The same day, Mirae Asset Global Investments and the crypto exchange Bithumb each reported separate cybersecurity incidents, though neither confirmed that customer data had been taken. The three disclosures form a fresh wave of attacks on South Korea's financial industry, according to TechCrunch.
The Daishin breach exposed customer names, email addresses and mobile phone numbers. The data set contains no account credentials or financial account numbers, so the practical risk is identity-linked phishing (fraudulent messages that use real personal details to win trust) and SIM-swap social engineering. In a SIM swap, an attacker uses a victim's personal details to persuade a mobile carrier to move the victim's number onto a SIM card the attacker controls. Direct access to bank accounts is not the immediate concern. Officials were still investigating the root cause of the October 28 breaches as of that date.
The Financial Services Commission (FSC), South Korea's financial regulator, called for stronger cybersecurity measures after attacks on financial firms and government agencies. It also planned security checks on dozens of private-sector IT systems. The checks are a plan, and their scope and timetable had not been completed.
The current wave follows a run of incidents that began in late September 2026. Security researchers linked the September attacks to a suspected China-based hacker using Artex, an AI-based penetration testing tool (software normally used to simulate attacks and find weaknesses before criminals do). The Straits Times reported in early October that suspicion had fallen on a single attacker using AI to breach financial firms, and that personal data had been exposed at seven firms by then.
On October 4, President Lee Jae Myung ordered a probe into data leaks across the financial industry. An emergency meeting originally scheduled for October 7 was brought forward after additional breaches were found at second-tier financial institutions. The following day, Lee said AI appeared to have been used in the bank hacks. Police were investigating breaches at several major lenders at that time.
The count has grown since. As of October 14, South Korea had found hacking incidents at a total of 16 financial firms, and around 100,000 cases of customer data exposure had been identified across the sector, according to Reuters. That same day, the FSC met with officials from related organizations on cybersecurity management in the financial sector, with the stated purpose of bolstering anti-hacking measures.
South Korea has seen this kind of exposure before. Lotte Card, which issues credit and debit cards, was breached between July 22 and August 2025. In April 2025, telecom operator SK Telecom suffered a cyberattack that led to the theft of personal data.
The broader context here is the data itself. Names, email addresses and mobile numbers carry little value individually. Combined across 16 firms and roughly 100,000 exposure cases, they form a usable base for targeted phishing and impersonation, particularly where the same identifiers are reused in one-time-password (OTP, a short code sent to a phone to confirm a login) and account-recovery flows. The reporting attributes the campaign to tooling that automates reconnaissance and exploitation, which lowers the skill and time required per target. Whether the root cause of the October 28 incidents matches the September pattern is not yet established.
In my view, the more consequential question for the sector is less about any single intrusion than about whether security checks on IT systems can keep pace with an attacker that can probe many firms in parallel. Regulators can mandate audits quickly. Verifying that audited systems are actually hardened, and that customer-facing identifiers are protected against reuse in authentication, takes longer.
The same day, the commission held its seventh meeting on propelling a transition to inclusive finance, with officials from related organizations and private-sector experts. Officials discussed a comprehensive evaluation system for financial companies. Seventeen domestic banks would be sorted into three groups (large banks, small and medium-sized banks, and internet-only banks) and assessed relative to peers in their group. The Financial Supervisory Service will oversee the process, and an evaluation committee chaired by a private-sector appointee will decide final results. Companies will be assessed annually on the previous year's performance, with results announced in March. The system will extend to the non-banking sector from next year. Officials also discussed ways to strengthen management of non-performing loans (loans where borrowers have stopped repaying) at public financial institutions.
On October 26, the commission reported progress on benchmark rate reform since the plan was announced in March. KOFR-OIS transactions (interest rate swaps referenced to the Korea Overnight Financing Repo Rate, a newer benchmark) exceeded the 10 percent goal for the first-year period from July 2025 to June 2026, standing at 12.1 percent. They reached around 18.5 percent in the third quarter of 2026. The target for the second-year period, July 2026 to June 2027, is 25 percent, with a goal of 70 percent or more by June 2030.
The benchmark reform and the inclusive finance evaluation are separate tracks, but both sit with a regulator whose immediate agenda is now dominated by the breach wave.
In my view, how quickly the commission converts its cybersecurity plans into verifiable controls will determine whether the sector's customer data exposure stops at the current tally.
