South Korea's national police have opened a formal investigation into the hacking of seven financial firms, assigning 28 investigators across four teams, The Korea Herald reported Tuesday. The breaches have now exposed data on about 66,000 people and about 2,200 corporate records, and authorities issued a consumer alert warning that scammers may exploit the stolen details.

What Happened

The Korean National Police Agency's cyberterrorism investigation unit launched the probe Tuesday. Seven firms have confirmed breaches: Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital.

Shinhan Bank accounts for 25,729 affected customers and Yegaram Savings Bank for roughly 40,000 records, according to The Korea Herald. The exposed information includes names, phone numbers, resident registration numbers, annual income and loan limits.

RelatedDealership IT Vendor Reports Attack Surge, Says MFA Was in Place When Logins Were Stolen

Woori Bank and NH NongHyup Bank were reportedly hit by similar attacks, but no leaks have been confirmed at either lender.

The Financial Supervisory Service has linked 28 IP addresses to the attacks, shared them with financial companies and asked the firms to complete internal security checks by Thursday. The Korea Times put the number at about 30 addresses spread across a dozen countries, including the United States, Japan, Singapore and Germany, and noted officials' caution that the location of an IP address does not establish who the attacker is or where the attack came from.

Why It Matters

The case began with a single disclosure. Shinhan Bank reported its breach Oct. 1, and regulators then ordered checks across the sector that uncovered leaks at other banks and lenders. On Monday, The Primary Wire reported that authorities had tied all seven breaches to one attacker, possibly using an AI tool. Tuesday's steps turn that finding into a national criminal investigation.

The type of data stolen raises the risk for customers even though no money has been taken. Resident registration numbers are a core identifier in South Korea, and income and loan-limit details give fraudsters convincing material. Authorities issued a caution-level consumer alert and opened a monthlong special response period, warning that scammers may pose as loan advisers or promise breach compensation to lure victims, according to The Korea Times. No customer financial losses had been confirmed as of Tuesday, the paper said.

The AI Question

Korea University professor Kim Seung-joo, quoted by The Korea Herald, suggested that the attacker may have used ARTEX, an AI tool that identifies security vulnerabilities. Investigators have not confirmed that. Kim warned that more AI hacking tools will appear and will lower the skill needed to carry out attacks.

President Lee Jae Myung called for faster development and deployment of AI built for cybersecurity and for an overhaul of security frameworks, saying speed is essential.

What to Watch

Financial firms face the Thursday deadline to finish the security checks ordered by the Financial Supervisory Service, which could turn up further breaches. Whether Woori Bank and NH NongHyup Bank lost any customer data is still unresolved.

Police are also weighing whether to refer the case to the newly created Serious Crimes Investigation Agency, a decision tied to the Financial Services Commission's classification of the affected systems as electronic financial infrastructure. Any first reports of fraud using the leaked data would test the monthlong response period the government has just opened.