What happened on October 28, 2026?
Three South Korean financial companies disclosed data breaches on the same day, extending a hacking wave that began in late September. Daishin Securities, Mirae Asset Global Investments and the crypto exchange Bithumb all reported intrusions on Wednesday, according to Yonhap News Agency.
Daishin gave the most detail. The brokerage said personal information belonging to 38,490 customers had been hacked, including names, email addresses and mobile phone numbers. It detected signs of unauthorized access the previous week and has been investigating with authorities. The company also said it had notified affected customers.
Daishin added that customers would be compensated if the leak causes them damage. "If the data breach causes damage, the brokerage will compensate them in accordance with law," the company said, as reported by Yonhap.
Mirae Asset Global Investments confirmed a breach of internal systems. The firm told Seoul Economic Daily that no retail investor data or unique identification information had leaked, and that hackers appeared to have viewed employee names. It reported the incident to financial authorities on Oct 28.
Bithumb's case is still taking shape. Korea Times reported that personal data of hundreds of customers leaked from an in-house mobile system. KBS World reported that the exchange became aware on Tuesday that information from its mobile groupware had been hacked, and that investigators were still determining whether customer data was affected.
Financial authorities have begun an on-site inspection at Mirae Asset. None of the three firms has said that customer passwords or payment credentials were taken.
The timing was awkward for the government. The three disclosures landed on the same afternoon that the presidential Office of National Security was scheduled to meet the Financial Services Commission to assess damage and discuss prevention, according to Korea JoongAng Daily.
How large is South Korea's data breach wave?
The disclosures cap a month of near-continuous bad news for the sector. On Oct 14, the Financial Services Commission (FSC) said 16 companies across the financial industry had confirmed breaches. It put the volume at about 100,000 pieces of customer data, covering names, contact details, resident registration numbers and email addresses.
The FSC described that figure as the position at the time of its Oct 14 meeting, leaving open the possibility of more cases.
"The extent of data breaches is estimated to be about 100,000 pieces of customer data," the FSC said in a statement after a cybersecurity meeting. The regulator added that it had found no reported theft of account passwords or credit card numbers that would point to fraudulent transactions.
Earlier incidents explain much of that total. Shinhan Bank said around 25,000 customers had names, phone numbers and annual income leaked, Yonhap reported on Oct 4. Hana Bank disclosed 89 affected customers. Woori Bank and NH Nonghyup Bank were targeted but blocked the attempts.
KB Kookmin Bank's figure grew over time, from 119 customers in early October to 2,210 customers and staff by late October, according to Korea JoongAng Daily.
Smaller institutions featured early in the wave. Korea Herald reported that BNK Financial Group lost 11 records. Yegaram Savings Bank became a cautionary tale: Chosun Ilbo reported the breach occurred on Sept 30, and the bank initially described a limited leak before admitting the full scope, SBS News said more than 50,000 customers were affected, including social security numbers and addresses.
The political response has been unusually direct. President Lee Jae Myung ordered a thorough investigation on Oct 4. His spokesperson, Kang Yu-jung, said Lee had told authorities to "conduct a thorough investigation and spare no effort in coming up with measures to address the issue."
Regulators also tested the industry's readiness. All 555 companies completed a 12-point checklist, the FSC said. A total of 425 described their cybersecurity measures as appropriate, while 130 reported gaps, mostly in security patching and control systems, and more often in electronic financial services and online peer-to-peer lending.
The FSC also distributed the IP addresses linked to the attacks, plus a self-evaluation checklist, to every financial company. That is an unusual step, in effect pooling threat intelligence across competitors that normally keep incidents private.
Was AI used in the attacks?
That question is central to the story and, so far, only partly answered. Korean officials have warned about AI-assisted attacks but have not published a technical finding for each breach. The FSC said investigators are examining whether the incidents are linked and whether artificial intelligence was used.
The Financial Supervisory Service's governor, Lee Chan-jin, pressed firms to harden their defences against automated attacks. KBS World reported that he urged the financial sector to improve its IT security to guard against AI-based hacking attacks. Yonhap, citing sources, said Shinhan had been hit by hackers using advanced AI tools; that characterisation has not been formally confirmed.
The most detailed public technical account comes from CrowdStrike. On Oct 7, its intelligence team published research linking infrastructure used against South Korean financial organisations to an open-source agentic penetration-testing tool called ARTEX, developed in China.
According to CrowdStrike, the server at 38.244.50[.]120 hosted an ARTEX instance that was "likely responsible for the described Korean attacks." The tool used DeepSeek v4.1-flash as its main language model, supplemented by GLM-5.3 from Zhipu AI and Grok 4.6 for additional Claude Code sessions.
The campaign ran from late September to early October, the firm said. It reported that attackers breached a loan progress inquiry service used by financial brokers at one bank, and an employee mobile work-support system at another. Session logs also showed the operator asking an AI assistant where stolen Korean data is typically sold.
The session logs also showed the operator asking an AI assistant how to find Korean data-sales groups on Telegram, CrowdStrike said.
CrowdStrike found the trail through open directories the operator left exposed. Those folders held Claude Code session histories, ARTEX configuration files and memory files, which together revealed a two-server setup. A Hong Kong-based address served as primary infrastructure, while 38.244.50[.]120 hosted the ARTEX instance.
The tool is described as a recently released open-source project, a detail that matters because open-source attack tooling can be picked up by other groups. CrowdStrike also warned that "adversaries will likely continue to experiment with implementing AI tooling in their operations" to raise the pace of attacks.
Those findings matter because they show how AI tooling can shorten the time between reconnaissance and intrusion. They do not prove that every breach in the Korean wave used ARTEX. CrowdStrike itself described the link as likely rather than certain, and Korean regulators have not endorsed that specific attribution.
Who is behind the attacks?
Two different pictures have emerged, and both remain provisional. Korean authorities have pointed to North Korean IP addresses. Private researchers have pointed to a financially motivated, Chinese-speaking operator.
On Oct 21, the Financial Supervisory Service issued a notice through its integrated security monitoring system after detecting suspicious scanning from the IP range 175.45.176.0/22, much of which is associated with North Korea. Korea JoongAng Daily reported that authorities recorded about 4.4 million access attempts by the time of the notice, with scanning starting at 3 a.m. that day.
The notice went to banks, crypto exchanges and other financial firms. It asked them to review monitoring, check records for access attempts from the flagged addresses and report anything unusual.
No confirmed breach or financial loss has been tied to those attempts. The FSS has also cautioned against reading too much into the addresses. "Some IP addresses cannot be traced to a specific country," the agency said on Oct 6, adding that attackers may route traffic through other locations.
CrowdStrike's assessment cuts the other way. It said the activity has not been attributed to a named adversary, but that "the threat actor is likely a Chinese speaker and financially motivated." The firm based that judgment on moderate confidence, citing the Chinese-developed tool and Chinese-language prompts in the leaked session files.
Both explanations could be wrong, and they are not mutually exclusive in principle. North Korea has a long record of attacking banks and crypto exchanges for revenue. Criminal groups also buy and reuse tooling and infrastructure. What the public record supports is a fast, automated campaign against weak entry points, not a settled culprit.
Which customers are affected, and what should they do?
The exposed data is the kind that fuels phishing rather than immediate account takeover. Names, phone numbers, email addresses and, in some cases, resident registration numbers give fraudsters material for convincing calls and messages. The FSC said it had not seen password or card-number leaks that would raise alarm about fraudulent transactions.
Regulators issued a consumer alert on Oct 6 warning about phishing and loan scams that could follow the breaches. In that notice, the FSC and FSS said "depositors should refrain from being overly concerned about the safety of their deposited funds."
The FSC said it would raise its consumer alert from Level I, Caution, to Level II, Warning, if confirmed phishing damage emerged.
The alert matters because the leaked fields are the kind scammers use to sound credible.
Customers of the named firms should expect notification and should verify any message that asks for credentials, codes or transfers. A call that cites a real name, address or partial account number is not proof of legitimacy; that is precisely the data now circulating.
For Daishin clients, the brokerage has said it will compensate for damage caused by the leak in line with the law. Crypto users should treat unsolicited messages about wallets, withdrawals or verification as suspicious, especially where they ask for seed phrases or one-time codes.
Companies face the harder task. Under Korean rules, affected firms must block the attacker's IP addresses, patch systems and notify customers about the consumer protection measures available to them.
What is South Korea changing for banks and crypto?
The FSC has set out four medium-term measures. It plans an exhaustive inspection of financial companies' cybersecurity management systems. It wants faster reporting and sharing of threat data between firms and regulators.
The regulator also intends to create a legal basis for more frequent vulnerability testing. Finally, it will consider expanding support for small and medium-sized financial companies, which it said need help against AI-driven risks.
Lee raised the issue at a regular meeting with board chairs from eight bank holding firms on Oct 28, KBS World reported.
Scope is widening beyond banks. Korea JoongAng Daily reported that authorities plan to extend security rules to the crypto sector, a move that would bring exchanges such as Bithumb closer to the regime applied to lenders.
Bithumb is the only crypto exchange publicly named in this wave so far. Korea JoongAng Daily reported that unauthorized access to internal groupware was found there on Tuesday, and that the exchange said no crypto wallet or payment data had been confirmed as leaked.
That distinction matters. A leak of names and phone numbers is painful for customers but does not by itself move funds. A wallet or withdrawal-system compromise would. So far, the public record points to the first kind of incident, and Bithumb has not reported losses.
The Oct 14 checklist results explain the emphasis on small firms. The 130 companies reporting gaps were concentrated in segments with less cybersecurity capacity, including electronic financial services and peer-to-peer lending. Those are the businesses regulators now say need more support.
The Oct 14 checklist results explain the emphasis on small firms. The 130 companies reporting gaps were concentrated in segments with less cybersecurity capacity, including electronic financial services and peer-to-peer lending. Those are exactly the businesses least able to absorb a breach, and the most likely to be used as a way into larger networks.
What to watch next
Expect the numbers to move. Korean disclosures have repeatedly been revised upward, as KB Kookmin's jump from 119 to 2,210 shows. Regulators' inspection of Mirae Asset and Bithumb may add customers to the count, and earlier figures may be restated.
The key unresolved question is linkage. Authorities are testing whether the incidents share attackers, infrastructure or methods. A confirmed common campaign would change the response from firm-level clean-up to something closer to critical-infrastructure defence.
Attribution will stay contested. North Korean IP ranges and a Chinese-speaking criminal operator are different hypotheses with different policy consequences, and neither has been established in public. Watch for technical reports that publish indicators, not just country names.
Finally, watch the rules. Mandatory vulnerability testing and crypto-sector oversight would raise costs for smaller firms and could reshape how Korean finance handles third-party systems. For customers, the practical test is simpler: whether notifications arrive quickly, and whether the next wave is smaller than this one.
A single, well-documented technical report tying the Korean breaches to one actor would settle more than another round of statements. Until then, the safest reading is that several weaknesses were found and exploited at once.