Sixteen Korean financial firms account for about 100,000 presumed data leaks so far

The unit is cases, and the reports do not say whether a customer whose name, e-mail address and phone number all leaked ^[4] counts as one case or three, or how the cases split among the firms. If each field counted separately and every record held all three, the same 100,000 cases ^[1] would be about 33,000 customers ^[10]. Spread over 16 institutions, 100,000 cases averages about 6,250 each ^[9].

In our view the 100,000 rises. The affected institutions are still examining whether there were further breaches ^[6], and we would expect the open examinations to add more cases than they remove. The counter-case is that a presumed figure can be cut as readily as raised once logs are matched against what was actually taken. A third path comes from the hacking-methods inquiry, where authorities are testing whether AI was involved ^[7]: if the back-to-back leaks ^[3] trace to one method, the 16 incidents would share a single cause.

The view fails if the FSC's line on sensitive data does not hold. The regulator said bank account numbers, credit card numbers and other sensitive data were not leaked ^[5], and it said so while the examinations were still open ^[6]. A later count that includes any of those fields would mean direct fraud exposure for customers.

On cost, the reports cover the FSC's announced next steps, security inspections at financial firms and measures for early detection and joint response ^[8], and say nothing of penalties or remediation costs.