Three more South Korean lenders, KB Kookmin Bank, Hana Bank and BNK Financial Group, have disclosed data leaks in the days after Shinhan Bank reported a breach affecting about 25,000 customers, The Korea Herald reported Friday. Financial regulators held an emergency meeting the same day and ordered banks to tighten security on systems reachable from the internet.

What Happened

KB Kookmin, the country's largest lender, said attackers got into an employee mobile support system and exposed the names, phone numbers, addresses and resident registration numbers of 119 customers. The bank found the intrusion Wednesday night and shut down the server and the routes used to reach it.

Hana Bank said its ODS sales support system was compromised, exposing resident registration numbers, names, addresses, contact details and employer names for 89 customers. It said no financial transaction data leaked. Hana reported the incident to the Financial Supervisory Service Thursday after learning of intrusions at another bank, blocked suspicious IP addresses and set up an emergency response team. It is notifying affected customers and has said it will compensate them.

RelatedDealership IT Vendor Reports Attack Surge, Says MFA Was in Place When Logins Were Stolen

BNK Financial Group reported 11 compromised records containing personal information on outsourced staff.

KED Global reported that the affected systems at KB Kookmin and Hana are separate from the banks' internet and mobile banking platforms.

The Primary Wire reported Thursday on Shinhan's breach, in which intruders bypassed identity checks on a mobile inquiry service used by loan agents and took names, phone numbers, annual income and loan limits, along with 66 resident registration numbers and 97 CI identifiers.

Regulators Respond

The Financial Services Commission met Friday with the FSS and security officials. It ordered banks to check all externally accessible systems, strengthen authentication and access controls and share threat information faster, and said it would investigate the attacks and revise regulations.

Why It Matters

Four disclosures in a few days turn a single bank's incident into a sector problem, and they share a pattern. None of the banks has reported an intrusion into its core banking platforms. Instead attackers reached secondary systems built for employees, sales staff or loan brokers, which hold the same customer data but often have weaker login protection. Resident registration numbers are a lifelong national identifier in South Korea and are difficult to replace once exposed.

The Seoul Economic Daily reported that the attacks relied on credential stuffing, in which login combinations stolen from other breaches are fed automatically into the target systems. Son Kyu-sik of Hanyang Cyber University told the paper that internet-facing systems with weak authentication are exposed to AI-automated attacks.

The AI Tooling Question

Moon Jong-hyun, head of the Genians Security Center, said in a LinkedIn post Friday that he found ARTEX on web servers believed to be involved in credential-stuffing and API attacks against several Korean sites, the Seoul Economic Daily reported. ARTEX is an open-source, Chinese-language penetration testing system that combines a large language model with multiple agents to automate reconnaissance, vulnerability scanning, attack planning and verification.

Neither Shinhan nor the authorities have confirmed the tool was used in the bank breaches. Moon noted that ARTEX has legitimate uses in authorized security testing but could make real attacks faster and more automated if abused.

What to Watch

Inspections of externally reachable bank systems are likely to turn up more weaknesses, and more lenders could report incidents as the checks proceed. The FSC's rule revisions should indicate whether regulators will require multifactor authentication or monitoring of bulk queries on partner and staff portals. Forensic findings on how the attackers obtained working credentials, and whether automated AI tools were involved, have not been released.