Welcome Savings Bank Investigates Breach Affecting Up to 2,200 Corporate Records

Welcome Savings Bank is investigating a cyberattack that may have compromised up to 2,200 records linked to corporate customers, the latest data-security incident to affect South Korea’s financial sector.

The savings bank discovered signs of the attack during an internal security check on Saturday and reported the incident to financial authorities. It is now working to establish how the breach occurred and determine the full scale of any exposure.

The potentially affected information includes company names as well as the names, email addresses and telephone numbers of corporate contact persons. The estimate is an upper limit, and the investigation has not yet established that every one of the 2,200 records was accessed or extracted. Welcome Savings Bank has also not publicly detailed the attack method or identified who may have been responsible.

The disclosure broadens concerns about cyber risk in the country’s financial industry. Financial institutions hold information that can be useful for targeted fraud even when it does not include account balances or payment credentials. Corporate contact data can identify employees who communicate with a financial institution, making clarity about the precise records involved and the way the system was accessed important for affected businesses.

A separate statement from South Korea’s financial regulator on Sunday said the possibility that artificial intelligence was used in recent hacking attacks on financial companies could not be ruled out. The regulator said, however, that the exposure of sensitive information had not been confirmed. That assessment concerned the wider series of incidents and did not establish that AI was used against Welcome Savings Bank.

The bank’s report to regulators moves the case from an internal technical review into a matter subject to official oversight. Investigators will need to distinguish between records that were merely present in the affected environment and data that attackers actually viewed, copied or transmitted. That distinction will shape the final count and the response required from the institution.

For now, the confirmed facts remain limited: the bank detected a hacking-related incident during its own inspection, notified the authorities and identified a possible exposure involving corporate customer records. The cause, exact number of affected records and extent of any resulting harm remain under investigation.