Photo: Julio Lopez / Pexels
Yonhap reports hackers may have used AI to automate a credential-stuffing attack on one of South Korea's largest lenders
Hackers may have had some help from artificial intelligence when they broke into a Shinhan Bank platform and exposed information tied to about 25,000 customers, Yonhap News reported.
What happened at Shinhan #
Unauthorized access to Shinhan’s systems ran from the early hours of September 29 into September 30, 2026. The bank’s systems flagged suspicious activity at around 9:30 a.m. on September 29.
The target was not the bank’s core banking infrastructure. Attackers went after a loan-broker inquiry platform, a separate system that sits apart from the machinery handling deposits and transfers.
Personal and financial details of about 25,000 customers were exposed. Among the compromised records were 66 resident registration numbers, along with 97 encrypted identifiers.
For context, a resident registration number is South Korea’s national ID number. It is roughly the equivalent of a Social Security number in the US, the kind of identifier that is very hard to change once it is out in the wild. Initial investigations suggest the attackers used advanced AI tools to run what is known as a credential-stuffing attack. Technically, credential stuffing takes usernames and passwords leaked in earlier breaches elsewhere and tests them, at scale, against a new target. It works because people reuse passwords.
How regulators and the bank responded #
South Korea’s Financial Supervisory Service moved quickly, launching an on-site inspection at the bank.
AI, tech, and the markets they move—in one daily briefing.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
Shinhan, for its part, set up an emergency task force and put preventative measures in place. The bank also told customers it would fully compensate them for any losses tied to the incident.
Shinhan Financial Group disclosed the breach in a 6-K filing. That is the form foreign companies with US-listed securities use to report material developments to American investors, which means this incident is now part of the group’s official record on both sides of the Pacific.
Shinhan was not alone in having a rough week. On October 2, 2026, KB Kookmin Bank reported its own, smaller breach affecting more than 100 customers.
Background: the automation problem #
Just months prior, in July 2026, various banks, including Shinhan, began integrating generative AI in their cybersecurity protocols for penetration testing and threat detection, anticipating a wave of increasingly sophisticated cyber-attacks.
What the Shinhan case highlights is the risk of automated hacking against financial institutions specifically. Banks have spent years hardening their core systems. The softer targets now tend to be the peripheral platforms, like broker portals and inquiry tools, that connect to customer data without sitting at the center of the operation.
What this means #
For Shinhan, the immediate costs are reputational and operational. Compensation pledges, a regulatory inspection, and an emergency task force all cost money and management attention. The research findings suggest investors may grow more cautious about exposure to institutions seen as vulnerable. They also suggest capital could potentially shift toward firms that specialize in AI-driven cybersecurity, and away from traditional banking stocks.
Banks that respond by pouring money into advanced security protocols and defensive AI may come out more resilient. In the short term, though, that spending could raise operating costs and pressure profit margins.
What to watch next: the findings from the FSS on-site inspection, whether investigators confirm the role of AI in the attack, and whether other South Korean lenders disclose similar incidents.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our