South Korea to run security checks at 580 financial firms after data leaks at 37 companies

South Korea’s Financial Services Commission said on Thursday that more than 470,000 personal data records had been leaked from 37 companies across the financial sector over the past month, with the funds stolen estimated at 1 billion won (US$745,000). The commission held a meeting in Seoul the same day with officials from financial trade associations and government agencies, including the Financial Supervisory Service and the Financial Security Institute, to review data protection systems and artificial intelligence capabilities.

Since 30 September, when the first leak was detected, 40 incidents have been reported at 37 companies, including four commercial banks, five financial investment firms, three insurance firms and five savings banks, according to the commission. It will now run security checks at 580 financial companies and review their internal security controls by the end of November.

FIVE GROUPS AT THE TOP

Five groups, KB, Shinhan, Hana, Woori and NH NongHyup, own the largest commercial banks alongside securities, insurance and card subsidiaries, and the country’s ten financial holding companies had consolidated assets of KRW 4,391.0tn at end-June 2026, 71.3% of it in banking, according to the Financial Supervisory Service.

TokenPost had reported that the commission would meet the chiefs of five major banks on 5 November to review financial-sector security, naming KB Kookmin Bank, Shinhan Bank, Hana Bank, Woori Bank and NH NongHyup Bank as the participating banks. The terms of all five bank presidents run through 31 December, and succession procedures have started at Woori, Hana and Shinhan, the outlet said.

WHAT LEAKED AND WHAT DID NOT

The commission said the leaked data did not include sensitive personal information that could be used for illegal financial transactions, such as customers’ names, national identification numbers or bank account numbers.

Funds held by some smaller brokerages, insurers and online financial businesses were stolen, while their customers’ money remained intact, the regulator added.

TechFlow reported that the chairman would hold a meeting on 5 November on AI security threats in the financial industry, with priority on preventing AI-driven cyberattacks, detecting and responding to AI voice phishing and building a next-generation cybersecurity infrastructure, alongside a review of security measures already ordered.

A WARNING TO CHIEF EXECUTIVES

“We will not tolerate practices that cause incidents or exacerbate damage by ignoring known security risks, neglecting even basic management duties or relying on perfunctory inspections and complacent responses,” FSC Chairman Lee Eog-weon said.

“We will strictly hold management, including the CEO, accountable in accordance with relevant laws and regulations for serious management failures or negligence in response,” he added.

THE TGB VIEW

Four commercial banks among 37 affected companies is a small share of the incidents. What raises the stakes for bank boards is the calendar: TokenPost reports that the terms of the presidents of all five participating banks run through 31 December, with succession under way at Woori, Hana and Shinhan. KB Financial Group ranks 66th in the TGB Bank Rankings with a 9.9% return on equity and Shinhan Financial Group 67th at 8.6%. The commission’s review of internal security controls at 580 firms is due by the end of November.