Korean bank AI hacks raise scrutiny as third-party risk exposed

Regulators may reinforce supervisory expectations around cyber controls, said Fitch.

Hacking incidents at South Korean financial institutions are likely to raise regulatory scrutiny and impose extra costs on banks, said Fitch Ratings.

Several Korean banks—including Shinhan Bank, Kookmin Bank, and KEB Hana Bank—and non-bank financial institutions reported hacking incidents suspected to be driven by artificial intelligence (AI) in early October 2026.

Fitch said that the breaches reported involved customer personal data accessed through external websites and servers used by loan agents and employees, rather than core banking platforms, the credit rating company said in a 6 October 2026 commentary.

“No material direct financial losses have been disclosed, and disruption to critical banking operations appears limited,” Fitch said.

These incidents are likely to raise regulatory scrutiny as financial institutions expand digit operating models, Fitch said.

Fitch noted that South Korea’s Financial Services Commission has been refining network-separation requirements to support cloud adoption, software-as-a-service deployment, and greater use of generative AI.

“We do not expect recent attacks to reverse that direction, but they may reinforce supervisory expectations around cyber controls across all systems, including externally linked applications and third-party connections,” Fitch said.

Financial costs should remain manageable, said Fitch, which said that primary consequences are likely to be on remediation, compliance, and reputational costs rather than on material earnings or capital pressures.

Fitch warned that AI tools could increase the frequency, speed, and scale of cyber-attacks, and that they test the effectiveness of banks’ risk controls.

“Risks may be greater for institutions that rely more heavily on third-party vendors, external distribution channels and customer-facing digital platforms, where vulnerabilities can be harder to monitor than within core internal systems,” Fitch said.