Security · October 21, 2026
Five major bank CEOs apologize for data breaches and pledge security upgrades
The heads of five major commercial banks in South Korea appeared before a parliamentary audit committee to apologize for recent personal information leaks. They pledged to expand their security budgets and staffing levels to prevent future incidents. The Financial Services Commission stated that it would investigate the root causes thoroughly and could hold chief executive officers accountable for the failures.
The audit session took place on October 19 at the National Assembly. The five bank presidents testified as witnesses, marking the first time all five leaders appeared together since 2022. Lawmakers focused their questions on the timeline of the breaches, the scope of customer compensation, and the specific information protection systems in place at each institution.
Data released by a lawmaker indicated that the time between the initial hack and the bank's awareness of the incident varied significantly. The longest delay was recorded at the first bank, taking 67 hours and 41 minutes. The second bank took 41 hours and 44 minutes, while the third bank took 15 hours and 26 minutes. One bank president acknowledged that the institution had initially treated the hacker's first intrusion as abnormal traffic and only blocked the IP address, which allowed a second attack to leak data from 81 additional people.
Another bank reported that approximately 89 people's personal information was leaked. Its president explained that the delay in announcing a specific compensation plan was due to the time needed to organize the details. The bank stated it had initially waived fees and would provide full compensation for any future damages, even if no immediate harm was detected.
The third bank suffered the largest scale of data leakage among the group. Its president expressed deep regret and noted that the bank was the only one to issue an apology letter in the president's name and announce a full compensation plan immediately after the incident. However, a lawmaker pointed out that only 22 percent of customers had checked whether their information was leaked, suggesting a limitation in the response.
Two other banks reported that they detected intrusion attempts but confirmed no actual data leakage. Their presidents promised to strengthen their security frameworks. One president noted that over 200 hacking attempts occur daily, and while staffing was increased, further reinforcement is needed. The other president mentioned the introduction of a next-generation integrated monitoring system in 2022 and committed to continued efforts.
The Financial Services Commission announced it would conduct supervision equivalent to a full investigation. Its head stated that while there are realistic limitations, the agency would move from sampling vulnerable parts to a comprehensive review. The head also indicated that this incident would be the first case where the responsibility of a chief executive officer is examined regarding internal control management duties. Regarding network separation policies, the head said a complete immediate implementation is difficult and that a phased transition is necessary to minimize external exposure while ensuring basic compliance.