[Edaily Reporter PARK JONG-HWA ] Personal information leaks are occurring simultaneously across the banking sector due to attacks by hackers.

Hana Bank announced on the 2nd that the personal information of 89 customers was leaked due to an external hacking attack involving an artificial intelligence (AI) agent. The leaked information included key details such as names, resident registration numbers, addresses, email addresses, cell phone numbers, and employer names.

The hackers reportedly extracted this information through Hana Bank’s Operations Support System (ODS). Hana Bank stated that this system is separate from its internet and mobile banking transaction systems and is therefore unrelated to any leakage of financial transaction data.

Hana Bank said, “We are taking this incident very seriously and will do our utmost to thoroughly investigate the cause and establish measures to prevent a recurrence in close cooperation with relevant authorities,” and promised to fully compensate customers whose personal information was leaked.

This is the fourth confirmed personal information leak at a bank this week alone. KB Kookmin Bank also announced today that the personal information of 119 customers had been leaked through its mobile business support system. At BNK Busan Bank, personal information—including the contact details of outsourced employees—was leaked due to a hacking attack. The previous day, Shinhan Bank confirmed an incident in which the personal information of approximately 25,000 customers—including resident registration numbers, linked information (CI), and annual income—was leaked through a loan application status inquiry system. In Shinhan Bank’s case, it is presumed that the hacking was carried out by an AI agent, similar to the incident at Hana Bank.

As security incidents occurred simultaneously across the financial sector, financial authorities also launched on-site investigations. Shin Jin-chang, Secretary-General of the Financial Services Commission, convened major financial institutions for an emergency meeting today and stated, “Financial companies must identify all IT assets and services exposed to the outside world without exception and thoroughly inspect security vulnerabilities and the status of access controls.” Secretary Shin emphasized, “Threat intelligence—including the IP addresses used in the attacks, attack methods, and details of intrusion attempts—must be swiftly shared between relevant agencies and financial institutions.” He added, “Since intrusion attempts targeting individual financial institutions could occur similarly at other institutions, the financial sector must cooperate closely to mount a joint response.”