Week 40, 2026 security incident report
Hacking and data breach incidents newly reported 2026.09.28 ~ 10.04
From 28 September to 4 October, 14 new cybersecurity incidents occurred in South Korea, with personal data leaks following one after another in the financial sector, including banks and savings banks. The leak of information on 25,729 Shinhan Bank customers was the most widely reported with 47 articles, about 50,000 people's information was leaked at Yegaram Savings Bank, and the possible leak of 1 million congregant records was raised at two large churches in South Korea. Among all types in South Korea and abroad, personal data leaks were the most common at 29, and those affected in South Korea went well beyond financial customers to include current and former employees and contractors of Korea Electric Power Corporation (KEPCO) and outsourced bank developers. Overseas, an intrusion into a US Department of Defense personnel information server exposed information on some 3.05 million people, and cyber-attacks on local governments disrupted administrative services and utility bill payments.
By type
- Data breach30
- Ransomware15
- Hacking & intrusion11
- Malware1
Key incidents in South Korea
Shinhan Bank loan agent service hack exposes 25,729 customers’ data
25.7kImpact: Personal information of 25,729 customers
Unauthorised access that bypassed identity verification on Shinhan Bank’s mobile website for loan agents resulted in the leak of information belonging to 25,729 customers. The leaked data included names, telephone numbers, annual incomes, loan limits and some resident registration numbers. The bank apologised and promised full compensation for losses, later providing affected customers with insurance covering up to KRW 10 million in losses from subsequent financial fraud, as well as preferential fees.
Related reports: 52 · last report →KB Kookmin Bank employee app hack exposes 2,210 people's personal information
2.2kImpact: Personal information of a total of 2,210 customers and current and former employees
A hack of KB Kookmin Bank's employee app that began on 27 September exposed the personal information of customers and current and former employees, and the bank became aware of it three days after the attack began. A re-examination of the original incident identified 2,091 additional victims, increasing the total number affected from the initially announced 119 to 2,210. The exposed information included customers' account numbers, deposit balances, loan transaction histories and credit ratings, with the types of information exposed varying by individual.
Related reports: 35 · last report →Hana Bank cyber-attack exposes 89 customers’ personal information
89Impact: Personal information of 89 customers
An external cyber-attack on Hana Bank exposed the personal information of 89 customers. The breach and emergency response arrangements became known on 2 October, and financial authorities held an emergency meeting on information leaks in the banking sector. The specific data exposed and the route of intrusion have not been confirmed.
Related reports: 25 · last report →Yegaram Savings Bank hack leaks data of about 50,000 customers
50kImpact: Personal data of about 50,000 customers
Yegaram Savings Bank was hacked, leaking customers' personal data including names, dates of birth and contact details. The scale of the damage was initially estimated at about 40,000 people but was later reported to be 53,000. The Financial Supervisory Service began an on-site check on 13 October 2026, and considered escalating it to a full inspection.
Related reports: 23 · last report →KEPCO breach exposes data of employees, retirees and contractor staff
35.5kImpact: A breach affecting 35,528 people was confirmed, followed by confirmation of an additional leak affecting 65 retirees
Personal data, including names and employee numbers, belonging to approximately 24,000 KEPCO executives and employees was exposed on an external webpage. The number of people affected expanded to 35,528, including retirees and contractor employees, and an additional leak involving the names, telephone numbers and other data of 65 retirees was announced on 29 October. KEPCO’s president apologised and pledged to overhaul security operations, while the relevant authorities are investigating the circumstances and cause of the breach.
Related reports: 13 · last report →Welcome Savings Bank hack exposes about 2,200 corporate customer records
2.2kImpact: Estimated exposure of about 2,200 corporate customer records
A hacking incident at Welcome Savings Bank on 27 September was estimated to have exposed about 2,200 corporate customer records. The bank discovered the breach on 2 October while checking attack IP addresses shared by the Financial Security Institute. It obtained ISMS-P certification after the incident.
Related reports: 7 · last report →Signs of hacking at two large South Korean churches raise fears of leak of 1 million members' records
1mImpact: Possible leak of 1 million member records; donation records
Signs of hacking were found at two large churches in South Korea, and an investigation into a possible leak of members' personal information was carried out. The member records at risk number 1 million, and a leak of donation records was also reported. Pastor Lee Young-hoon apologised, saying he felt responsible for the hacking incident.
Related reports: 6 · last report →iM Bank and Baro Savings Bank infected with malware, no customer data leaked
Impact: Malware infection at two financial institutions; no customer data leaked
iM Bank and Baro Savings Bank were infected with malware in 2026. Customer information was not leaked.
Related reports: 5 →BNK Busan Bank web server attack exposes data of 11 outsourced developers
11Impact: Personal information of 11 outsourced developers
BNK Busan Bank suffered an attack using AI agents against an external web server on 1 October 2026. A subsequent inspection confirmed that personal information belonging to 11 outsourced developers had been exposed on some web pages. BNK then carried out a comprehensive review of its information security response framework to prepare for increasingly sophisticated cyber-attacks.
Related reports: 4 · last report →Data breaches confirmed at two online peer-to-peer lenders
302Impact: Personal data of 302 people leaked at PFCT
Data breaches were confirmed at two online peer-to-peer lending companies. At one of them, PFCT, the personal information of 302 people was leaked.
Related reports: 3 · last report →
Key incidents in other countries
Frontline Education hack exposes data on more than 3.08 million people
3.1mImpact: Personal information of 3,085,266 students and staff members
Unauthorised access exploiting a vulnerability in third-party software occurred at Frontline Education on 14–15 August, resulting in the theft of information on students and staff in US school districts. Affected data from Frontline Central and school health management services included names, Social Security numbers, dates of birth, government-issued identification numbers, Medicaid and student identification numbers, and school health and billing records. Individual notifications have begun, and at least six class action lawsuits are under way. A filing in Indiana confirmed that 3,085,266 people were affected.
Related reports: 14 · last report →Iranian Extradited to US Over $3.4 Billion Cyber-Attack Case
Impact: Alleged scale of the case: $3.4 billion
An Iranian national suspected of involvement in a $3.4 billion cyber-attack case has been extradited from Montenegro to the United States. The institutions affected by the attack and the specific methods used have not been confirmed.
Related reports: 13 · last report →US Defense Department personnel server intrusion exposes data of about 3.05 million people
2.8mImpact: Personal data of 2.76 million living and 294,000 deceased individuals
Unauthorised access to a server at the US Department of Defense's personnel data centre exposed unencrypted data on 2.76 million living individuals and 294,000 deceased individuals. The exposed data included Social Security numbers, names, dates of birth, contact details and military job information. A later lawsuit filed by Marines alleged that the department had left security flaws unaddressed before the incident.
Related reports: 12 · last report →Japan's Times Car hack exposes information of up to 948,500 members
948.5kImpact: Information of up to 948,500 members
Japanese car-sharing service Times Car was hacked, exposing information belonging to up to 948,500 members. Former members' driving licences were also leaked, prompting concerns about a policy of keeping data for seven years after membership ends. Times Car decided to provide users with compensation worth ¥3,000, while victims pursued a class action lawsuit.
Related reports: 10 · last report →Ransomware attack shuts down Vicksburg city IT systems in the US
Impact: City IT systems shut down
The city of Vicksburg, Mississippi, in the United States, shut down its IT systems following a ransomware attack. The city issued a statement about the cyber-attack and carried out work to restore its systems.
Related reports: 10 · last report →