Skip to content
Today
Sign in

InvestNot yet confirmed elsewhere1 publisher2 min readPublished

After Shinhan directors warned against neglecting security investment, a bank hack exposed 25,000 customers

Shinhan Financial's board took up information security five times between March 2025 and May 2026, according to minutes Seoul Economic Daily reviewed. Analysts quoted by the paper say the effectiveness of those security systems needs examining.

The Investor · Invest desk

How we use AISend a correction

Photograph accompanying After Shinhan directors warned against neglecting security investment, a bank hack exposed 25,000 customers
Photo: koreatimes.co.kr
Shinhan directors warned before the Card leak report Security remarks and agenda items at Shinhan Financial's board and a Shinhan Bank board workshop, as reported by Seoul Economic Daily.

March 2025: Song Sung-joo urges security investment against AI attacks. August 2025: Kwak Soo-keun: incidents recur without timely investment. October 2025: Yamamoto Shinji says one breach can lead to liquidity crisis. January 2026: leak report. February: security measures. May: audit report.

  1. 2025Song Sung-joo: don't neglect investment against AI attacks, claim 2
  2. 2025Kwak Soo-keun: incidents recur without timely investment, claim 3
  3. 2025Shinhan Bank workshop: one breach can lead to liquidity crisis, claim 6
  4. 2026Board gets report on Shinhan Card merchant data leak, claim 4
  5. 2026Board deliberates group-wide security measures, claim 4
  6. 2026Board receives audit report on the security system, claim 4
Shinhan directors warned before the Card leak report
DateEventClaim
March 2025Song Sung-joo: don't neglect investment against AI attacks2
August 2025Kwak Soo-keun: incidents recur without timely investment3
October 2025Shinhan Bank workshop: one breach can lead to liquidity crisis6
January 2026Board gets report on Shinhan Card merchant data leak4
February 2026Board deliberates group-wide security measures4
May 2026Board receives audit report on the security system4

What happened

  • Song Sung-joo, an outside director, told a special Shinhan Financial board meeting in March 2025 that the group must not neglect investment and improvement efforts against novel AI-based attacks.
  • The same board received a report in January 2026 on a leak of Shinhan Card merchants' personal data, deliberated group-wide security measures in February, and took an audit report on the system in May.
  • At a Shinhan Bank board workshop in October 2025, outside director Yamamoto Shinji warned that a single security breach could be devastating enough to lead to a liquidity crisis.
  • Regulators revised the electronic financial transactions supervision rules last year to strengthen board oversight, requiring chief information security officers to report major security matters to the board.

Why it matters

  • contradiction Woori's board voiced similar worries and no breach is confirmed there, while Shinhan's board did the same and its units were breached, so the warnings alone do not sort the breached from the unbreached.
  • constraint Because the revised rule obliges CISOs to report to boards, a growing stack of security agenda items is in our view partly compliance output. On its own, the stack does not show rising vigilance.
  • decision Regulators who want to test effectiveness have to ask each firm for outlay and drill data, because the agenda items they already receive cannot answer the question analysts are raising.

Kwak Soo-keun, an outside director at Shinhan Financial, made the investment argument in August 2025. He made it as a prediction: "Strengthening internal controls is important, but similar incidents will recur unless timely investment in human and material resources is made at the business level." [3] Five months separated that remark from the January 2026 report on the Shinhan Card merchant leak [11][4]. None of the board items described is a spending approval. The account does not include a budget figure or the method of the Shinhan Bank intrusion, so what management did with the warning is not visible.

This reading could be wrong. Shinhan may have spent heavily and been hit through a path that money did not close, in which case the warnings worked and the breach was a residual. The 25,000 customers exposed [5] may be the small end of a larger attempt, which no outsider can observe. Or the intrusion was not AI-driven at all. Then Song Sung-joo's March 2025 warning about novel AI-based attacks [2] is not the one that failed, and only the general call for investment is left to test.

In our view the minutes establish that directors paid attention. A control needs a measurable output behind it, and some boards asked for one. KB Financial's directors told the group in March 2025 to "go beyond documented procedures and strengthen internal training and campaigns so that all employees recognize the importance of security and can actually carry out those procedures." [8] Hana Bank's Kwon Young-sun asked the risk management committee last year for hacking drill cases and business continuity simulation results [7]. Of all the requests in the account, it is the only one that would produce a test result.

Kim Dae-jong, a business administration professor at Sejong University, said regulators should conduct a comprehensive review of effectiveness [15]. A review of that kind could falsify our reading. If Shinhan's security outlays rose after Kwak's August 2025 warning and its drills passed, the minutes record a control working on a lag and the bank hack is the residual.

What to watch

  • Whether Shinhan or its regulators publish security outlay or drill results that can be set against Kwak Soo-keun's August 2025 call for investment.
  • How the Shinhan Bank intrusion is attributed: if it was not AI-driven, Song Sung-joo's March 2025 warning is not the one that failed.
  • Whether Korean regulators act on calls for a comprehensive effectiveness review, and whether Woori stays free of a confirmed breach.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence55
Adoption
Insufficient
Hype gap+15
Incentives
Insufficient
Confidence55
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Boards of South Korea's major financial groups have warned about AI-driven cyberattack risks since last year and called for stronger defenses, according to board minutes reviewed by Seoul Economic Daily.

    ReportedSupportedSource: Seoul Economic Daily, via en.sedaily.comView cited source
  2. [2]

    Song Sung-joo, an outside director at Shinhan Financial Group, reviewed the company's response to novel AI-based attacks at a special board meeting in March last year (2025) and said the firm must not neglect investment and improvement efforts to defend against them.

    ReportedSupportedSource: Seoul Economic Daily, citing financial industry sources and board minutesView cited source
  3. [3]

    Kwak Soo-keun, a Shinhan Financial outside director, said in August 2025, in connection with information security risk management: "Strengthening internal controls is important, but similar incidents will recur unless timely investment in human and material resources is made at the business level."

    ReportedSupportedSource: Seoul Economic Daily, citing board minutesView cited source

Sources

1 independent publisher whose own reporting we read for this story.

  1. en.sedaily.com

    1 article · October 12, 2026

    Breaches Persist Despite Board Warnings on AI-Driven Hacking Risks

Share your take

Let Clarity write the post for you.

Signed-in readers get a short post drafted on this story in the register they choose — narrative, analytical, or a direct position — editable to the last word before it goes anywhere. The share buttons at the top of this story work without an account.

Create a free account to composeSign in

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

Loading related stories