KB Capital reports data breach affecting 1,811 individuals

A computer screen displays lines of code — Rob Wingate / Unsplash

KB Capital experienced a security incident resulting in the leakage of personal information for 1,811 individuals. The breach affected 20 customers and 1,791 employees of partner companies and internal staff. The company disclosed the incident on its official website on November 12, 2026.

The compromised data included names, dates of birth, mobile phone numbers, addresses, and vehicle registration numbers for the customers. For the partner company employees and internal staff, the leaked information comprised user accounts, names, mobile phone numbers, landline numbers, department names, company names, and job titles. The majority of the affected individuals were not general financial consumers but rather employees of partner firms and internal staff.

The incident occurred within a vehicle rental asset management system used for business operations. KB Capital stated that this system is not directly related to financial transactions. The company detected the breach on November 10, 2026, while addressing a server load issue. Investigators found traces of abnormal information queries originating from domestic internet protocol addresses. The company identified these activities as a malicious external attack.

Upon discovering the breach, KB Capital immediately stopped the affected systems and servers and blocked external access paths. The company enhanced monitoring for abnormal access and reported the incident to the Financial Supervisory Service on the same day it was detected. The firm confirmed that no customer account information or financial transaction records were leaked. The specific method of the attack, such as exploitation of system vulnerabilities, account theft, or authentication bypass, has not been determined.

It remains unconfirmed whether passwords or authentication information were included in the compromised user accounts. It is also unknown if the attacker gained additional access to other internal systems. The company apologized for the incident and stated it would fully compensate for any damages resulting from the data leakage. The exposure of internal organizational details, such as department names and job titles, could potentially be used for impersonation or targeted phishing attacks.