South Korean President Orders Probe Into Bank Data Leaks as More Lenders Report Breaches

South Korean President Lee Jae Myung on Sunday ordered a thorough investigation and response measures over a wave of personal data leak incidents hitting banks, finance companies and public agencies, Seoul's presidential office said.

The directive escalates a crisis that has been spreading across the country's financial sector for the past week. Authorities launched on-site investigations after Shinhan Bank reported a breach on September 30, and the probes have since expanded to other reported incidents.

On Friday, the Financial Services Commission (FSC) said Shinhan Bank, KB Kookmin Bank and others had reported cyberattacks. Yonhap news agency reported that Hana Bank and Woori Bank had also suffered breaches, widening the circle of affected institutions.

FSC Chairman Lee Eog-weon convened an emergency meeting on Sunday with financial industry associations, regulators and executives from affected institutions. The meeting was brought forward from October 7 after additional breaches were discovered at second-tier financial institutions, according to multiple Korean media reports.

Yonhap, citing bank data submitted to lawmakers, said attack traffic appeared to have originated from IP addresses across several countries, including the United States, Japan, Singapore, Vietnam and Britain.

Regulators believe the attacks may have broadly scanned multiple financial companies for vulnerabilities rather than targeting a single institution.

The FSC chairman said authorities could not rule out the possibility that artificial intelligence was used in the attacks and called for an "AI attacks defended by AI" approach, while signalling broader upgrades to the financial sector's cybersecurity framework.

The country's main opposition People Power Party said authorities should also investigate the possibility of North Korean involvement, citing past cyberattacks attributed to Pyongyang against South Korean financial institutions.

The regulator directed financial institutions to carry out comprehensive security inspections, tighten access controls, minimise external system access and strengthen consumer protection measures. It also said attack methods, IP addresses and other threat information would be rapidly shared across the industry to prevent further incidents.

The banks could not immediately be reached for comment outside regular working hours on Sunday.