Skip to content
RegionAsia-Pacific

MediumII Cyber Warfare & Critical Infrastructure19 October 2026, Monday

Heads of Korea's five biggest banks apologise to parliament over hacking

The chief executives of KB Kookmin, Shinhan, Hana, Woori and NH NongHyup testified together at a National Assembly audit on 19 October, the first such joint appearance since 2022. Lee Chan-jin, governor of the Financial Supervisory Service (FSS), said it would be the first cyber case in which senior executives' responsibility is examined.

Location: SEOUL

According to the Seoul Economic Daily, Shinhan Bank chief Jung Sang-hyuk expressed deep regret over the leak of customer data. KB Kookmin's Lee Hwan-joo pledged adequate budget and staff and said the bank would counter attacks with AI-based security systems. He added that network separation rules, which wall internal systems off from the internet, cannot be scrapped in one go and should be phased out gradually. FSS governor Lee Chan-jin said losses would be compensated in full.

Digital Today reported on 20 October that breaches had been confirmed at 16 financial institutions as of 14 October, with roughly 100,000 records thought to have leaked. About 50,000 records, including identity and account numbers, leaked from Yegaram Savings Bank, where the FSS has begun an on-site inspection. At OK Savings Bank, account, income and credit details of 518 customers were exposed. An emergency audit of 555 financial institutions found shortcomings at 130, including unapplied patches and weak access controls.

The regulatory response is turning into a budget question. The Financial Services Commission plans to require large institutions to run vulnerability scans at least twice a year and is weighing a shared monitoring system for smaller ones. The four big commercial banks spent only 68.0% of their information security budgets last year. KB Kookmin plans a security budget of more than 100 billion won for 2027. Sources differ on which committee held the hearing: the same report names both the Political Affairs and the National Policy Committee.

Talay assessment

Bottom line

In Korea, a cyber breach is ceasing to be a technical fault and becoming a risk item the board must answer for. The pledge of full compensation and the scrutiny of senior executives push banks to raise security budgets and to shift from network separation rules to AI-based defences. Shortcomings at 130 of 555 institutions keep the odds high that the wave of breaches continues among smaller firms.

Likely effects

  • Bank costsNegative1–6 months

    The full-compensation pledge and criticism of 68.0% budget execution point to a marked rise in security spending in 2027, eating into profitability.

  • Smaller financial institutionsNegativeWeeks

    Successive leaks at savings banks and cooperatives suggest the weakest link will remain in this segment until a shared monitoring system is in place.

  • Executive accountabilityUncertain6 months+

    The first case to examine senior executives' responsibility could set a precedent for other regulators in the region in tying cyber breaches to the board.

Possibilities, ranked

  1. 1
    Leaks continue at smaller firms55%

    New breaches surface at savings banks and cooperatives, and the number of confirmed institutions rises above 16.

    Watch: Updated breach counts from the FSS and the Financial Services Commission

  2. 2
    Swift regulation and sanctions30%

    The FSS turns on-site inspections into formal investigations, at least one institution's executive is sanctioned, and network separation rules are amended in stages.

    Watch: A formal investigation order against Yegaram Savings Bank

  3. 3
    The wave subsides15%

    No new breaches are reported, and the debate shifts to compensation payments and budget plans.

    Watch: No new breach notifications throughout November

Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.

Market reaction

Indicators affected

  • Institutions with confirmed breaches▼ 16
  • Leaked records (est.)▼ ~100,000
  • Institutions with shortcomings▼ 130/555

Sources

  1. Seoul Economic Daily — Heads of Korea's Top 5 Banks Apologize for Hacking Breach, Vow AI-Based Defenses
  2. Digital Today — Financial sector hacking spreads, delays gain support for digital asset tax postponement