South Korea’s FSC Discloses New Wave of Financial Sector Breaches

South Korea’s Financial Services Commission disclosed a new round of hacking incidents across the country’s financial industry on October 28, 2026, convening an emergency inspection meeting over a breach at virtual asset exchange Bithumb and confirming additional customer information leakage at Daishin Securities.

The emergency meeting was chaired by Digital Finance Policy Director-General Yu Yeong-jun and joined by the Financial Supervisory Service (FSS), the Financial Security Institute (FSI), the digital asset exchange alliance DAXA and Bithumb, the FSC said in a Korean-language release. The meeting addressed infringement incidents affecting major virtual asset operators.

Bithumb reported to the authorities that it had confirmed signs that abnormal external access had leaked employee information of Bithumb, its subsidiaries and partner companies, and that it was still verifying whether user information had been leaked. The exchange also reported that the breached system was one supporting employees’ work, not the core computing facility for virtual asset trading, and that no leakage of information usable for fraudulent payments or virtual asset transfers, such as virtual asset wallet addresses, had been confirmed so far.

The FSC said incident reports had recently been filed by Mirae Asset Life Insurance and Mirae Asset Global Investments, and that additional customer information leakage at Daishin Securities was confirmed in the course of the incident investigation. Daishin Securities posted a notice titled “Notice of personal (credit) information leak and an apology” on its official notice board at 09:59 on October 28, 2026.

Regulator Response and Planned Security Upgrades

The FSC, FSS and FSI said they immediately launched on-site investigations, rapid information sharing among related agencies and close cooperation, and would make every effort to identify the cause of the incidents. The authorities said they would check thoroughly so that no consumer damage occurs and, if damage does occur, would manage and supervise so that consumer protection measures such as full compensation are implemented.

The FSC said it will pursue multi-faceted measures to strengthen security to the level of major financial companies such as banks for sectors not currently subject to the Electronic Financial Transactions Act, including the virtual asset sector, and to secure a rapid response posture when incidents occur. For secondary financial sector companies including Mirae Asset Life Insurance, Mirae Asset Global Investments and Daishin Securities, the FSS and FSI will conduct thorough incident investigations and victim protection measures, the regulator said.

Prior October Breach Wave

The October 28 disclosures extend a series of breaches the FSC had begun addressing earlier in October 2026. At an October 14, 2026 meeting on cybersecurity management in the financial sector, the FSC said 16 companies in total had been confirmed to have experienced data breach incidents across all financial sectors, according to the regulator’s English-language release. The extent of the breaches was estimated at about 100,000 pieces of customer data, including names, contact information, resident registration numbers and email addresses, and no hacking incidents involving breaches of account passwords or credit card numbers had been reported at that time.

Authorities instructed the affected companies to immediately block the IP addresses linked to the hacking attacks, apply additional measures such as security patches or suspension of services, and take all necessary consumer protection steps. Through on-site reviews, the FSS and the FSI were examining individual incidents to determine attack vectors and patterns, whether the incidents were associated with one another, whether they originated from the same attacker, and whether artificial intelligence had been used in the hacking incidents.

A 12-point cybersecurity checklist was completed by all 555 financial companies, the release said: 425 companies reported their cybersecurity management measures as appropriate, while 130 identified areas needing improvement. The reported inadequacies were mostly related to security patches or control systems and appeared more in the electronic financial service and online peer-to-peer lending sectors, which the release described as having relatively lower cybersecurity capacity than more traditional sectors.

At the October 14 meeting, authorities also discussed four policy measures: an exhaustive inspection of financial companies’ cybersecurity management systems; improved response mechanisms so that cyber threat risks identified by individual companies can be quickly reported to the authorities and shared with other financial companies; a regulatory ground requiring more frequent and regular cyber vulnerability tests; and consideration of expanded cybersecurity support for small- and medium-sized financial companies to help them respond to AI-driven cybersecurity risks.

Earlier, on October 6, 2026, the FSC and the FSS issued a Level I (Caution) consumer alert over potential phishing attacks and loan scams following the personal information breaches, and opened a one-month special response period. Financial companies were instructed to operate help desks for affected consumers, strengthen fraud-detection monitoring of suspicious transactions involving stolen consumer data, and make active use of the AI-based anti-phishing Sharing & Analysis Platform (ASAP) to share phishing-related information. No phishing scams resulting in financial damage had been confirmed at that time, and the authorities said the alert would be raised to Level II (Warning) if confirmed cases of subsequent damage emerged.

CrowdStrike Details Agentic AI Campaign

CrowdStrike Intelligence reported on October 7, 2026, that it had identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data, active from late September to early October 2026. In that activity, the threat actor used ARTEX, a recently released open-source agentic penetration testing tool developed in China, alongside large language models, according to the report.

The report said analysis of threat actor-controlled open directories uncovered Claude Code session histories, ARTEX configuration files and Claude memory files. The ARTEX instance used DeepSeek v4.1-flash as its primary LLM backend, supplemented with GLM-5.3 and Grok 4.6 for additional sessions, and a Hong Kong-based IP address served as the primary attacker-controlled infrastructure. CrowdStrike assessed with moderate confidence that the threat actor is likely a Chinese speaker and financially motivated, based on the use of ARTEX and observed Chinese-language prompts; the activity has not been attributed to a named adversary.

Citing industry reports, CrowdStrike said that at one affected bank the threat actor reportedly breached a loan progress inquiry service used by financial brokers, and that at another bank the actor compromised an employee mobile work-support system. The report said the activity demonstrates how AI tooling can enable a financially motivated threat actor to conduct multiple intrusions within a short time span, and CrowdStrike assessed that adversaries will likely continue to experiment with implementing AI tooling in their operations.