South Korea’s Financial Services Commission (FSC), the country’s financial regulator, has instructed banks and credit card companies to carry out security reviews after cyberattacks hit Shinhan Bank, KB Kookmin Bank and other lenders.
According to The Korea Herald, the directive, issued on Friday, requires firms to audit every IT system that can be reached from outside their networks. The regulator plans to gather the findings quickly and use them to design new measures to tighten cybersecurity across the financial sector.
The order followed an emergency meeting led by FSC Secretary General Shin Jin-chang. Attendees reviewed the recent data breaches, including how the attackers operated, and discussed a response.
The attacks used artificial intelligence agents against weaker systems, such as a platform Shinhan Bank provides for loan agents and a mobile tool KB Kookmin Bank uses to support its staff.
Under the regulator’s instructions, financial companies must map all IT assets and services open to external access and test them for security flaws and weak access controls. The review applies to every externally reachable system, whether or not it serves customers and whatever service it provides. Firms must also reduce the information visible from outside, find any pathway that could expose internal data without authentication, and confirm that authentication applies whenever internal data is accessed.
Authorities will quickly distribute threat intelligence, such as attacker IP addresses, attack techniques and attempted intrusions, to relevant bodies and financial firms to coordinate the response. They will also issue a cybersecurity checklist to guide each firm’s internal review and will collect the completed results.
The FSC, the Financial Supervisory Service and the Financial Security Institute have begun on-site inspections of the incidents. They have passed details of the attacks, including attacker IP addresses and methods, to the Korea Internet & Security Agency and other relevant authorities. Regulators will also make sure that affected institutions protect their customers and pay compensation for any losses.
On Thursday, Shinhan Bank disclosed that data on roughly 25,000 customers was exposed after hackers compromised code linked to its communications infrastructure. An internal review at KB Kookmin Bank found that an external intrusion had exposed details of more than 100 customers.
According to financial industry sources, Hana Bank and BNK Busan Bank also suffered data leaks on Friday. Staff from the Financial Supervisory Service and the Financial Security Institute have been sent to all four banks to carry out on-site inspections.
Officials said Shin’s remarks reflected the urgency of establishing what data was leaked and how it was obtained, so that public concern can be eased. Shin also urged financial companies to carry out thorough checks “so that the public does not feel anxious,” according to officials.
“People will only feel reassured once it is confirmed that the leaked information was not directly related to their financial transactions,” a financial industry official said. “That is why financial companies were urged to conduct thorough checks.”
FSC secretary general Shin Jin-chang said, “We will closely monitor cyberthreats targeting the financial sector and work closely with relevant parties by sharing threat intelligence promptly. We will thoroughly analyze the causes and methods of the attacks and swiftly develop measures to strengthen the system.”
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
