[1mm Finance Talk] Major Data Breach Hits Commercial Bank: Shinhan Bank Faces Crisis Before CEO Appointment and National Assembly Audit

Information of 25,000 Customers Leaked in Hacking Incident
Easy Inquiry Service for Loan Brokers Targeted, Exposing Security Weaknesses
Consecutive Data Breaches Amid Sensitive Period Leading Up to CEO Appointment and National Audit
Major R

Shinhan Bank has been hit with a major crisis following a hacking incident that resulted in the personal information of 25,000 customers being leaked. As data breaches have recently occurred at card companies and other institutions, this latest incident at a commercial bank—where customer trust is foundational—has heightened tension across the financial sector. The situation is seen as a significant risk for Shinhan Bank in the second half of the year, particularly since the appointment process for the next CEO is underway and a National Assembly audit is approaching.

According to the financial industry on October 2, the Shinhan Bank data breach originated from the mobile homepage inquiry service used by loan brokers. Shinhan Bank has operated a service page where loan brokers could conveniently check the status of their loan applications, but the bank explained that an external, unauthorized party accessed the service without permission by circumventing authentication through abnormal means.

After gaining access, the hacker stole information such as whether the loan was applied for, the application amount, and the approved amount by repeatedly inputting random values like receipt numbers. Using customer numbers obtained through this method, they then accessed other simple inquiry services—such as checking internet banking registration and foreign exchange history—and extracted additional information including contact numbers and dates of birth.

Shinhan Bank identified the hacking breach on the night of September 29, when it noticed a sudden spike in inquiries to the relevant site. The bank fended off the attack until around 1:00 AM on the 30th, determined the scope of the leak, and reported the incident to the financial authorities by 9:00 AM that same day. To date, the leaked customer information affects about 25,000 people. The compromised data includes names, phone numbers, annual income, and calculated loan limits, all related to loan applications. For some customers, 66 resident registration numbers and 97 linked information (CI) records were also leaked.

This incident has raised questions about whether the security system for the simple inquiry service for loan brokers was adequate. The targeted service used a relatively vulnerable security method—such as SMS authentication—compared to typical financial services that rely on certificate-based authentication. Since the attacker was able to use the customer numbers obtained from this service to access other simple inquiry services, whether authentication and access control were sufficient for each service is expected to become a focal point in the financial authorities' investigation.

However, it is understood that the core banking systems—including Shinhan Bank's mobile apps—were not directly hacked in this case. The Financial Supervisory Service is conducting on-site inspections to determine the exact cause, scope of the breach, and any potential legal violations.

In front of Shinhan Bank headquarters, Jung-gu, Seoul. Photo by Yonhap News Agency

This incident is especially burdensome for Shinhan Bank and Shinhan Financial Group, which have consistently placed customer trust as their top management priority. In his speech for the group’s 25th anniversary in September, Chairman Jin Okdong of Shinhan Financial Group stressed, "Trust in a financial institution that manages customers' assets is not just one value among many—it is the starting point and the ultimate gateway for all decision-making and sustainable growth. This is the most important force driving Shinhan's next chapter."

The situation is made even more worrisome as it comes at a time when public concern over privacy is high following recent personal data breaches at Lotte Card and TVING. On September 30, President Lee Jaemyung wrote on X (formerly Twitter), "We now expect a proper system and workforce dedicated to data protection. Should a breach occur, there will be fines of a level that is difficult to bear, strong criminal penalties, as well as the possibility of collective lawsuits for civil damages."

The timing also heightens the sensitivity of the issue. Shinhan Financial Group has begun the succession process for the CEOs of its subsidiaries whose terms end at the end of the year. The term for Shinhan Bank CEO Jeong Sanghyuk also expires on December 31. With the National Assembly audit approaching, there is growing speculation in the financial sector that how the aftermath of the incident is managed and the results of the financial authorities' investigation could become a significant burden for Shinhan Bank executives going forward.

Other banks have undertaken their own security checks in the wake of the Shinhan Bank breach. Woori Bank—which suffered a leak of 17,551 records including nicknames and IDs in July due to an external developer’s error—is currently conducting vulnerability assessments using artificial intelligence and is working to enhance safety for linked data.

A financial industry official said, "As technologies for storing and protecting data become more advanced, the methods for stealing such information evolve even faster, leaving the entire industry in a state of heightened alert."

This content was produced with the assistance of AI translation services.