Shinhan Bank's 25,000-customer breach ran through a loan-broker inquiry portal

In July, various banks including Shinhan began building generative AI into their security work for penetration testing and threat detection ^[13]. Whatever raised Shinhan's alarm at 9:30 a.m. on September 29 ^[2], the unauthorized access ran on into September 30 ^[1]. That is at least 14 and a half hours after the flag ^[3].

Credential stuffing tests usernames and passwords leaked in other breaches against a new target at scale, and it works because people reuse passwords ^[8]. If the initial findings Yonhap reported hold ^[7], AI set the pace of the guessing. The opening was still a loan-broker inquiry platform, separate from the deposit and transfer systems ^[3]. It let reused logins reach data on about 25,000 customers ^[4].

The 66 resident registration numbers ^[5] are 0.26% of affected customers ^[1]. Add the 97 encrypted identifiers and the most sensitive records come to 163, about 0.65% ^[2]. Those 66 matter beyond their share because the number is South Korea's national ID, roughly a US Social Security number and very hard to change once it is out ^[6]. Crypto Briefing's account does not include a figure for Shinhan's compensation pledge or the cost of its task force.

The Shinhan case is one incident, and KB Kookmin's breach of more than 100 customers, reported October 2 ^[12], is the only other one in Crypto Briefing's account. The publication argues that banks have spent years hardening core systems ^[14]. The softer targets, in its account, now tend to be peripheral platforms such as broker portals and inquiry tools that connect to customer data ^[14]. I think this breach supports that, and the budget order follows: a system that accepts a password and can read customer records goes ahead of the deposit machinery. The view fails if the FSS on-site inspection ^[9] finds the broker platform was a route into something broader, since the split between core and periphery would no longer hold. It weakens but survives if investigators cannot confirm the AI role, because password reuse alone explains the entry ^[8].

Research findings cited by Crypto Briefing suggest capital could move toward AI-driven cybersecurity firms and away from traditional banking stocks ^[15]. On the numbers in hand, a breach of 25,000 records at one lender is an operating cost. I'd expect any sell-off in bank shares before the inspection reports to be pricing the AI label more than the bill. That judgement is wrong if the FSS finds weaknesses across several of Shinhan's platforms ^[9]. Crypto Briefing's own piece expects defensive spending to raise operating costs and pressure margins in the short term ^[16].