Week 40, 2026 security incident report
Hacking and data breach incidents newly reported 2026.09.28 ~ 10.04
From September 28 to October 4, 14 new cybersecurity incidents occurred in South Korea, with personal data leaks following one after another in the financial sector, including banks and savings banks. The leak of information on 25,729 Shinhan Bank customers was the most widely reported with 47 articles, about 50,000 people's information was leaked at Yegaram Savings Bank, and the possible leak of 1 million congregant records was raised at two large churches in South Korea. Among all types in South Korea and abroad, personal data leaks were the most common at 29, and those affected in South Korea went well beyond financial customers to include current and former employees and contractors of Korea Electric Power Corporation (KEPCO) and outsourced bank developers. Overseas, an intrusion into a U.S. Department of Defense personnel information server exposed information on some 3.05 million people, and cyberattacks on local governments disrupted administrative services and utility bill payments.
By type
- Data breach30
- Ransomware15
- Hacking & intrusion11
- Malware1
Key incidents in South Korea
Shinhan Bank loan agent service hack exposes data of 25,729 customers
25.7KImpact: Personal information of 25,729 customers
Unauthorized access that bypassed identity verification on Shinhan Bank’s mobile website for loan agents led to the leak of information belonging to 25,729 customers. The leaked information included names, phone numbers, annual incomes, loan limits, and some resident registration numbers. The bank apologized and pledged full compensation for losses, and later provided affected customers with insurance covering up to KRW 10 million in losses from subsequent financial fraud, along with preferential fees.
Related reports: 52 · last report →KB Kookmin Bank employee app hack exposes 2,210 people's personal information
2.2KImpact: Personal information of a total of 2,210 customers and current and former employees
A hack of KB Kookmin Bank's employee app that began on September 27 exposed the personal information of customers and current and former employees, and the bank became aware of it three days after the attack began. A reexamination of the original incident identified 2,091 additional victims, increasing the total number affected from the initially announced 119 to 2,210. The exposed information included customers' account numbers, deposit balances, loan transaction histories, and credit ratings, with the types of information exposed varying by individual.
Related reports: 35 · last report →Hana Bank hack exposes 89 customers’ personal information
89Impact: Personal information of 89 customers
An external hack of Hana Bank exposed the personal information of 89 customers. The breach and emergency response arrangements became known on October 2, and financial authorities held an emergency meeting on information leaks in the banking sector. The specific data exposed and the intrusion route have not been confirmed.
Related reports: 25 · last report →Yegaram Savings Bank hack leaks data of about 50,000 customers
50KImpact: Personal data of about 50,000 customers
Yegaram Savings Bank was hacked, leaking customers' personal data including names, dates of birth and contact details. The scale of the damage was initially estimated at about 40,000 people but was later reported to be 53,000. The Financial Supervisory Service began an on-site check on October 13, 2026, and considered escalating it to a full inspection.
Related reports: 23 · last report →KEPCO breach exposes data of employees, retirees and contractor staff
35.5KImpact: A breach affecting 35,528 people was confirmed, followed by confirmation of an additional leak affecting 65 retirees
Personal data, including names and employee numbers, belonging to approximately 24,000 KEPCO executives and employees was exposed on an external webpage. The number of people affected expanded to 35,528, including retirees and contractor employees, and an additional leak involving the names, phone numbers, and other data of 65 retirees was announced on October 29. KEPCO’s president apologized and pledged to overhaul security operations, while the relevant authorities are investigating the circumstances and cause of the breach.
Related reports: 13 · last report →Welcome Savings Bank hack exposes about 2,200 corporate customer records
2.2KImpact: Estimated exposure of about 2,200 corporate customer records
A hacking incident at Welcome Savings Bank on September 27 was estimated to have exposed about 2,200 corporate customer records. The bank discovered the breach on October 2 while checking attack IP addresses shared by the Financial Security Institute. It obtained ISMS-P certification after the incident.
Related reports: 7 · last report →Signs of hacking at two large South Korean churches raise fears of leak of 1 million members' records
1MImpact: Possible leak of 1 million member records; donation records
Signs of hacking were found at two large churches in South Korea, and an investigation into a possible leak of members' personal information was carried out. The member records at risk number 1 million, and a leak of donation records was also reported. Pastor Lee Young-hoon apologized, saying he felt responsible for the hacking incident.
Related reports: 6 · last report →iM Bank and Baro Savings Bank infected with malware, no customer data leaked
Impact: Malware infection at two financial institutions; no customer data leaked
iM Bank and Baro Savings Bank were infected with malware in 2026. Customer information was not leaked.
Related reports: 5 →BNK Busan Bank web server attack exposes data of 11 outsourced developers
11Impact: Personal information of 11 outsourced developers
BNK Busan Bank suffered an attack using AI agents against an external web server on October 1, 2026. A follow-up inspection found that personal information belonging to 11 outsourced developers had been exposed on some web pages. BNK subsequently conducted a comprehensive review of its information security response framework to prepare for increasingly sophisticated cyberattacks.
Related reports: 4 · last report →Data breaches confirmed at two online peer-to-peer lenders
302Impact: Personal data of 302 people leaked at PFCT
Data breaches were confirmed at two online peer-to-peer lending companies. At one of them, PFCT, the personal information of 302 people was leaked.
Related reports: 3 · last report →
Key incidents in other countries
Frontline Education hack exposes data on more than 3.08 million people
3.1MImpact: Personal information of 3,085,266 students and staff members
Unauthorized access exploiting a vulnerability in third-party software occurred at Frontline Education on August 14–15, resulting in the theft of information on students and staff in U.S. school districts. Affected data from Frontline Central and school health management services included names, Social Security numbers, dates of birth, government-issued identification numbers, Medicaid and student identification numbers, and school health and billing records. Individual notifications have begun, and at least six class-action lawsuits are underway. A filing in Indiana confirmed that 3,085,266 people were affected.
Related reports: 14 · last report →Iranian Extradited to US Over $3.4 Billion Cyberattack Case
Impact: Alleged scale of the case: $3.4 billion
An Iranian national suspected of involvement in a $3.4 billion cyberattack case has been extradited from Montenegro to the United States. The institutions affected by the attack and the specific methods used have not been confirmed.
Related reports: 13 · last report →US Defense Department personnel server intrusion exposes data of about 3.05 million people
2.8MImpact: Personal data of 2.76 million living and 294,000 deceased individuals
Unauthorized access to a server at the US Department of Defense's personnel data center exposed unencrypted data on 2.76 million living individuals and 294,000 deceased individuals. The exposed data included Social Security numbers, names, dates of birth, contact details and military job information. A later lawsuit filed by Marines alleged that the department had left security flaws unaddressed before the incident.
Related reports: 12 · last report →Japan's Times Car hack exposes data of up to 948,500 members
948.5KImpact: Information of up to 948,500 members
Japanese car-sharing service Times Car was hacked, exposing the information of up to 948,500 members. Former members' driver's licenses were also leaked, raising concerns over a policy of retaining data for seven years after membership ends. Times Car decided to offer users compensation worth ¥3,000, while victims pursued a class action lawsuit.
Related reports: 10 · last report →Ransomware attack shuts down Vicksburg city IT systems in the US
Impact: City IT systems shut down
The city of Vicksburg, Mississippi, in the United States, shut down its IT systems after a ransomware attack. The city issued a statement about the cyberattack and worked to restore its systems.
Related reports: 10 · last report →