AI-driven cyberattacks hit 16 financial firms, expose 100,000 records
A pedestrian passes a Seoul branch of the Korean Federation of Community Credit Cooperatives, Wednesday, one of the firms affected by the recent artificial intelligence-powered cyberattacks. Yonhap
The number of financial firms affected by suspected artificial intelligence (AI) agent-driven cyberattacks has risen to 16, more than double the seven initially reported, financial regulators said Wednesday.
About 100,000 records containing personal information, including resident registration numbers, were exposed. The tally could rise as companies continue checking their systems for signs of intrusion.
Regulators also found security deficiencies at 130 of the 555 financial firms reviewed, including failures to apply the latest security patches.
The Financial Services Commission (FSC) disclosed the findings at an emergency response meeting. It said the breaches, reported since the beginning of this month, have affected banks, savings banks, credit finance companies, electronic payment providers and cryptocurrency businesses.
The affected firms include four banks — Shinhan, KB Kookmin, BNK Busan and Hana — and four savings banks — Yegaram, Welcome, DB and OK. Hyundai Capital and KDB Capital are among the affected credit finance companies.
Others on the list include online investment firms PFCT and Mouda; electronic financial services provider Brightfix; cryptocurrency businesses Streami and Pravang; and the Korean Federation of Community Credit Cooperatives.
The leaked information includes names, contact details and resident registration numbers. Regulators have found no evidence so far that account or card numbers were compromised.
They are also investigating whether the attacks were carried out by the same hacking group.
The breaches have drawn attention to wider gaps in financial firms’ cybersecurity. Of 555 financial companies inspected across 12 areas through Oct. 8, 130, or 23.4 percent, were found to have deficiencies.
Common problems included missing security updates, inadequate oversight of systems no longer supported by manufacturers, a lack of 24-hour security monitoring and gaps in authentication and authorization for external systems. Such deficiencies were relatively widespread among electronic financial services providers and online investment-linked finance companies.
FSC Secretary General Shin Jin-chang, who chaired the meeting, said the findings were particularly troubling given repeated regulatory warnings following earlier incidents, including the massive 2025 Lotte Card data breach.
“It is deeply troubling that financial firms are still failing to meet basic security requirements despite repeated calls for comprehensive inspections and stronger controls,” he said.
The FSC plans to review security practices across the sector and pursue broader reforms, including measures to hold CEOs and boards more accountable.