Shinhan Bank, one of South Korea's largest lenders, said personal and credit information belonging to about 25,000 customers was leaked after an unauthorized outside party bypassed authentication on some of its services, The Korea Times reported Thursday. The main target was a platform used by loan brokers during the loan application process, and financial regulators have opened an emergency on-site inspection.

What Happened

According to the bank, the intruder reached customer information through abnormal access rather than through Shinhan's main customer website. The data exposed included customers' names, phone numbers, annual income, calculated loan limits and details of their loan applications. Among the affected records, 66 contained resident registration numbers, South Korea's national identification numbers, and 97 included connecting information (CI), an identifier Korean services use to link a person's accounts across providers.

Specialists cited by The Korea Times suspect credential stuffing, in which attackers try usernames and passwords stolen from other sites until some work. The bank has not confirmed the method or said when the unauthorized access began.

RelatedDealership IT Vendor Reports Attack Surge, Says MFA Was in Place When Logins Were Stolen

Shinhan said it set up an emergency response team, blocked the external IP addresses involved and suspended the affected services. It opened a page on its website and in its mobile app where customers can check whether their information was exposed, and set up a dedicated call center.

CEO Jung Sang-hyuk apologized and said the bank would take full responsibility and fully compensate customers for any losses caused by the leak. The bank said it would review its personal credit information protection system from the ground up and strengthen work processes and employee training.

Regulators Step In

The Financial Supervisory Service began an emergency on-site inspection after Shinhan reported the incident, and the FSS and the Financial Services Commission held an emergency meeting to discuss their response, according to the reports.

Why It Matters

The combination of data in this leak is useful to fraudsters. Income figures, loan limits and application details, paired with names and phone numbers, allow convincing impersonation of a bank or broker, for example in phone scams offering refinancing to people known to be seeking credit.

The entry point is also instructive. Partner-facing systems such as broker portals are built for a smaller group of external users and often get less scrutiny than a bank's consumer website, yet they can expose the same customer records. If credential stuffing is confirmed, it would mean broker accounts were protected by passwords alone, or by controls that did not detect large numbers of automated login attempts.

Context

The incident adds to a series of large data breaches in South Korea that has kept regulators focused on how companies protect personal information. KED Global's coverage pointed to e-commerce company Coupang's record 624.7 billion won ($409 million) fine over a personal data leak and to a 44.5 billion won hack of the Upbit cryptocurrency exchange that has been attributed to North Korea's Lazarus group.

What to Watch

The FSS inspection should establish how the intruders got in, how long they had access and whether more data was taken than the bank has reported so far. Sanctions are possible if regulators find that Shinhan's controls fell short of credit-information protection rules. Affected customers should expect follow-on phishing calls and texts that use their real loan details to appear legitimate.