Police Begin Preliminary Inquiry Into Bank Cyberattacks

South Korean police have begun a preliminary inquiry after a series of cyberattacks targeted domestic banks and led to confirmed personal-data leaks. The Cyber Terror Response Investigation Unit announced on October 2 that it was examining incidents reported by Shinhan Bank, KB Kookmin Bank, Hana Bank and BNK Busan Bank.

The inquiry is taking place before any formal criminal case has been opened. In South Korea, this early stage allows investigators to assess reported facts and decide whether there is sufficient basis to launch a full investigation and formally name suspects.

The incidents involve several banks reporting cyberattacks within a short period, but investigators have not yet established whether the attacks were coordinated or carried out by the same people.

What the Banks Have Reported

The disclosures came over two days. Shinhan Bank said information belonging to about 25,000 customers, including names and telephone numbers, had been exposed. KB Kookmin Bank reported a leak affecting 119 people, while Hana Bank said 89 customers were affected.

BNK Busan Bank reported that information belonging to 11 outsourced development workers had been exposed. The affected individuals were not all customers, illustrating how a breach can involve staff or contractors as well as account holders.

  • Shinhan Bank: About 25,000 customers; names and phone numbers were among the reported information.
  • KB Kookmin Bank: 119 people affected.
  • Hana Bank: 89 customers affected.
  • BNK Busan Bank: Information on 11 outsourced development workers exposed.

The reported figures describe the incidents disclosed by the banks as of October 2. The available information does not establish that account passwords, payment details or funds were accessed, and it does not show that every bank suffered the same type of breach.

AI Agents Are One Possible Lead, Not a Proven Cause

The incidents have raised questions about whether artificial intelligence may have played a role. Hana Bank and BNK Busan Bank have suggested that an AI agent (software that can carry out repeated tasks with limited human direction) may have been used in the attacks.

An automated tool can, for example, repeat a sequence of online actions much faster than a person. That possibility does not by itself explain how the attackers gained access, what information they sought, or whether AI was involved at all; those points remain matters for investigation.

Why Automation Matters

Cyberattacks often rely on repeated tasks, such as testing access routes or sending large numbers of requests to online services. Automation can make those tasks faster and easier to scale, but investigators still need technical evidence—such as system records and traces of access—to determine what tools were used and who operated them.

Two More Banks Reported Attacks Without Confirmed Leaks

Woori Bank and NH Bank also said they had experienced external cyberattacks. As of the announcement, however, neither bank had confirmed that customer information was exposed.

A reported attack and a confirmed data leak are not the same thing. An attacker may try to enter a system without obtaining information, while an institution may still need time to determine whether any data was viewed or copied.

For customers, that distinction matters: the number of confirmed leaks may change as banks complete their checks. The reports so far do not establish that every attempted attack resulted in stolen data.

A Potential First Major Cybercrime Case Under the Reformed System

If police move from the preliminary inquiry to a formal investigation, the case could become the first major cybercrime investigation handled by police after changes to South Korea’s criminal justice system took effect under a revised Criminal Procedure Act.

The change gives the case significance beyond the banking sector. A complex cybercrime inquiry can require investigators to compare system logs, trace how data moved between networks, identify the people or services used to access systems, and coordinate with banks and other relevant authorities.

What Investigators May Need to Establish

  • Whether the separate incidents share technical similarities or were carried out by the same actors.
  • Which systems were accessed and how attackers may have entered them.
  • Exactly what information was viewed, copied or removed.
  • Whether automated software, including AI agents, was used.
  • Whether additional banks or people were affected but have not yet been identified.

These are questions to be resolved through evidence, not conclusions already reached. The authorities have not announced a confirmed motive, a suspect or a final account of how the attacks occurred.

What Customers Can Do While the Inquiry Continues

People who received a notice from a bank should read it carefully and use the bank’s official app, website or published customer-service number to check what information may have been involved. They should be cautious of unexpected calls, text messages or emails that use news of the breaches to request passwords, verification codes or financial details.

A leaked name or phone number can make a scam message seem more convincing, even when no banking credentials have been exposed. Customers can reduce risk by avoiding links in unsolicited messages, never sharing one-time verification codes, and contacting their bank through a trusted channel if something appears suspicious.

The current reports confirm several data exposures, but they do not establish that every bank was breached or that account credentials and funds were compromised. Further findings will depend on the banks’ technical reviews and the police inquiry.

What Comes Next

The immediate task is to establish the scale and technical links, if any, between the reported incidents. Banks’ internal reviews and police examination of digital evidence may clarify whether the attacks used a shared method and whether additional information was exposed.

The case also highlights a broader security challenge for financial institutions: protecting customer information requires monitoring not only a bank’s main systems, but also the external services and work processes connected to them. Whether AI was involved or not, the investigation may prompt renewed attention to how banks detect unusual activity, report breaches and inform affected people.

For now, the central facts are that several banks disclosed attacks within a short period, four reported data exposures, and police have begun an initial inquiry. The allegations about AI-assisted attacks remain unconfirmed, and a formal criminal investigation has not yet been announced.