Top bank chiefs face grilling over cyberattacks

The National Assembly summoned the CEOs of KB Kookmin, Shinhan, Hana, Woori and NH NongHyup banks for a Financial Supervisory Service audit. Lawmakers want explanations for a recent wave of cyberattacks and the banks’ responses. It is the first time since 2022 that all five CEOs have been called together.

The named witnesses are Lee Hwan-ju, Jung Sang-hyuk, Lee Ho-sung, Jung Jin-wan and Kang Tae-young. Shinhan reported the largest disclosed breach, affecting about 25,000 customers. KB Kookmin reported leaks involving 119 people, including 99 customers and 20 employees. Hana reported a leak affecting 89 customers.

Woori and NH NongHyup also experienced similar attacks, but neither reported a data breach. The audit will examine cybersecurity and internal controls. It may also affect attention around the CEOs’ reappointments, since all five terms expire on December 31 and the Financial Supervisory Service is investigating.

A parliamentary audit is a formal review conducted by lawmakers to question public agencies, examine problems and demand explanations. South Korea’s National Assembly uses committees for these reviews. The audit here concerns the Financial Supervisory Service and the banks’ handling of cyberattacks. It matters because lawmakers can publicly test whether institutions acted responsibly.

Bank CEOs can be called when a committee approves a motion to summon them as witnesses. The National Policy Committee approved such a motion on October 8. That decision named the CEOs of KB Kookmin, Shinhan, Hana, Woori and NH NongHyup banks. Their role is to answer questions during the audit.

The summons does not itself prove wrongdoing. It creates a formal setting for questioning. Lawmakers are expected to focus on the attacks, disclosed personal data, cybersecurity spending and internal controls. The audit also brings senior executives directly into public scrutiny while the Financial Supervisory Service investigates the incidents.

The article reports three disclosed data breaches involving about 25,208 people in total. That figure combines Shinhan’s approximately 25,000 affected customers, KB Kookmin’s 119 affected people and Hana’s 89 affected customers. The totals are approximate because the Shinhan figure is reported as “about 25,000.”

Shinhan had the largest disclosed incident by a huge margin. Its breach affected about 25,000 customers. KB Kookmin’s leak involved 119 people, made up of 99 customers and 20 employees. Hana’s leak affected 89 customers. Together, the named breaches involved about 25,188 customers and 20 employees.

Woori and NH NongHyup also faced cyberattacks, but the article says those incidents did not result in data breaches. The figures therefore cover only the disclosed breaches at Shinhan, KB Kookmin and Hana. The scale explains why lawmakers are focusing on bank cybersecurity and customer protection.

A cyberattack is an attempt to disrupt, penetrate or misuse a computer system. A data breach is the specific outcome in which protected information is exposed, accessed or taken. One attack can fail to expose data. That distinction matters because the harm depends not only on the attack, but also on whether personal information was compromised.

Shinhan, KB Kookmin and Hana experienced attacks that resulted in disclosed data breaches. Shinhan’s incident affected about 25,000 customers. KB Kookmin’s leak involved 119 people, while Hana’s affected 89 customers. These incidents demonstrate the difference between an attempted intrusion and confirmed exposure of personal information.

Woori and NH NongHyup also faced similar attacks. However, the article explicitly says those incidents did not result in data breaches. It does not provide technical details about why the attacks failed or were contained. The key fact is that attacks occurred without reported exposure of customer or employee data.

Shinhan’s information-security budget is under scrutiny because its security spending appears lowest among the five major banks, even though it suffered the largest disclosed breach. The comparison raises questions about whether the bank devoted enough money to protecting systems and personal data. Lawmakers are expected to examine that issue during the audit.

Financial Supervisory Service data released by Rep. Park Dae-chul show that Shinhan earmarked 40.59 billion won for information security this year. That amount equals about $30.5 million. It was down 10.4 percent from the previous year. Shinhan was the only one of the five banks to allocate less than 50 billion won.

The article does not say that the budget caused the breach. It does show an uncomfortable combination: the most severe disclosed attack and the lowest security allocation. The audit may test how the bank set its priorities. The Financial Supervisory Service’s investigation of internal controls could add further pressure.

The audit and investigation could bring public and regulatory scrutiny to the banks’ cybersecurity, responses and internal control systems. Lawmakers will question the CEOs directly. The Financial Supervisory Service is separately investigating the circumstances of the incidents and the banks’ controls. Together, those processes could pressure banks to explain decisions and strengthen protections.

The most immediate leadership consequence concerns reappointment. All five CEOs’ terms expire on December 31. Four are seeking a first reappointment, while Shinhan CEO Jung Sang-hyuk is approaching the end of his second term. Before the attacks, strong earnings were expected to support relatively smooth reappointments for the Shinhan, KB Kookmin and Hana chiefs.

The article says the hacking incidents could complicate those chances. It does not announce penalties, dismissals or other final outcomes. Instead, it says the Financial Supervisory Service’s findings could potentially affect reappointments. The audit may therefore influence both institutional accountability and decisions about who continues leading the banks.

Modern banks rely on personal information to serve customers and run financial accounts. Protecting that information is therefore central to safe banking operations. A breach can expose customers and employees to harm and make people question whether a bank can safeguard sensitive records. Public trust matters because banking depends on confidence in institutions.

The article illustrates that risk through three disclosed incidents. Shinhan’s breach affected about 25,000 customers. KB Kookmin reported a leak involving 99 customers and 20 employees. Hana reported a breach affecting 89 customers. Woori and NH NongHyup faced attacks, but no resulting data breaches were reported.

The article does not measure changes in public trust or describe specific customer losses. It does show why protection is under scrutiny: five CEOs were summoned, and the Financial Supervisory Service is investigating circumstances and internal controls. Stronger accountability may be important for reassuring customers and maintaining confidence in the financial system.