Shinhan Bank Says Data of 25,000 Customers Leaked as Regulator Opens Probe

South Korea’s Financial Supervisory Service has launched an emergency on-site investigation into a data leak at Shinhan Bank, intensifying scrutiny of cybersecurity controls at one of the country’s largest lenders.

Shinhan Bank President Jung Sang-hyuk said Thursday that information belonging to about 25,000 customers had been exposed. He pledged that the bank would fully compensate customers for any losses caused by the incident.

The leak involved some information connected to loan solicitation, according to financial industry and regulatory officials. Authorities began inspecting the bank after learning that the data had been exposed the previous day. The exact categories of information and the full scale of the incident remained under review as of Thursday morning.

Officials said the intrusion did not appear to involve the bank’s login-authenticated banking services. That distinction suggests the investigation is focused on a separate channel rather than Shinhan’s main online banking access, although regulators had not yet released a complete technical account of how the data was obtained.

One possibility raised in connection with the incident was credential stuffing, a method in which attackers use account names and passwords obtained elsewhere and repeatedly test them on another service. Authorities had not publicly confirmed that method as the cause, and the inquiry was still examining the nature of the exposed information and the attack route.

The Financial Services Commission and the Financial Supervisory Service convened officials for an emergency review of the case. The on-site inspection is expected to examine the sequence of the breach, the systems affected, the bank’s detection and response measures, and whether customer notifications and protective steps were carried out promptly.

For Shinhan, the immediate task is to identify every affected customer and prevent misuse of the exposed data. The bank’s compensation pledge addresses direct financial harm, but the outcome of the regulatory review will also determine whether broader corrective measures are required.

The incident adds to pressure on Korean financial institutions to secure customer-facing digital services beyond their core banking platforms. Even when account-authenticated banking systems are not penetrated, exposure through peripheral services can create fraud and privacy risks. Regulators’ findings will be central to establishing the precise impact and whether additional safeguards are needed across the industry.