[2026 Parliamentary Audit] KB Kookmin Bank Denies Allegations of Data Leak Cover-Up

Bank's Handling of Hacking Incident Criticized at Political Affairs Committee Audit

Lee Hwanju, president of KB Kookmin Bank, denied political allegations that the bank may have covered up a customer data hacking incident, saying, “I never gave such an instruction.”

Lee Hwanju, president of KB Kookmin Bank; Jeong Sanghyeok, president of Shinhan Bank; Lee Hoseong, president of Hana Bank; Jeong Jinwan, president of Woori Bank; and Kang Taeyoung, president of NH Nonghyup Bank, take an oath as witnesses during a parliamentary audit of the Financial Supervisory Service and other institutions at the National Assembly on Oct. 19, 2026. Photo by Yoon Dongju

Lee made the remarks in response to a question from Kim Yong-man, a lawmaker from the Democratic Party of Korea, during a parliamentary audit by the National Assembly’s Political Affairs Committee that day.

Kim said, “I received a tip that, during a meeting of three relevant departments in the morning and the subsequent report to the CISO (chief information security officer), an executive in charge of information security ordered the deletion of logs,” and asked, “Did you know about this?”

Lee initially replied, “No,” but, after further questioning, clarified that he meant he had never instructed anyone to cover up the incident. When asked whether he had received a report, he said, “I have not heard about it. I was not briefed.”

Kim pointed out that KB Kookmin Bank was the first to come under attack but was slow to recognize the data breach, resulting in further data being leaked. According to Kim, a hacker accessed the bank’s systems at 11:19 p.m. on September 27, but the bank only blocked the IP address. In the early hours of September 29, a further 81 people’s information was leaked in a relay attack using a Vietnamese IP address. Kim criticized the bank for its slow response, noting that it did not finally confirm signs of a data breach until around 7 p.m. on September 30, about 80 hours after the initial intrusion, and that a report was made around 6 p.m. that day, just one hour before the statutory reporting deadline.

In response, Lee said, “As you pointed out, I have many regrets that we were unable to respond and block the attack quickly.”

However, responding to criticism that the bank learned of the breach only after the Financial Security Institute provided the attacker’s IP address, Lee said, “We identified unusual activity and blocked it ourselves on the morning of September 30, before the Financial Security Institute’s IP information arrived.” He added, “It took time to recognize the incident and confirm signs of a data breach.”

Meanwhile, Financial Supervisory Service Governor Lee Chan-jin said, in connection with a series of cyberattacks on the financial sector, “I believe this could be the first cyberattack case in which the question of a chief executive officer’s (CEO’s) accountability is addressed in relation to the duty to manage internal control standards.” His remarks were understood to mean that the FSS would examine CEOs’ responsibility for managing internal controls as it reviews the response to the hacking and the data leak.

In response to Kim’s call for the FSS to conduct a full-scale inspection, including of the non-bank financial sector, Lee said, “I have ordered a full-scale inspection, starting with vulnerable areas. We plan to conduct a sampling inspection, but we will do so on a scale equivalent to a full-scale inspection.”

On easing network separation regulations, Lee said, “It is difficult to do so across the board,” adding, “I think there are areas where we need to remain grounded in the basics while gradually transitioning to an AI security framework.” He continued, “The first step is to review whether we are prioritizing the basics while minimizing external exposure.”

This content was produced with the assistance of AI translation services.