Questions were raised at a parliamentary audit over whether IP addresses used in a recent hacking attack on Shinhan Bank also tried to access internet-only banks from January. Lawmaker Kim Hyeong-yeon said differing review periods among financial firms could miss intrusion traces and urged checks of at least one year of records. He criticised a Financial Supervisory Service checklist that does not specify review periods or criteria and called for stronger verification of supporting evidence. Kim also cited delayed incident detection, including a case taking 902 days to identify.

South Korea\'s financial sector faced a security emergency after a string of hacks and personal data leaks. Shinhan Bank had customer information for about 25,000 people leaked, while KB Kookmin Bank and Hana Bank confirmed leaks involving 119 and 89 customers. Regulators said related IP addresses linked to the same attacker were found across seven firms, with external-facing services used as attack routes. Authorities are investigating possible automated attacks using AI tools and ordered an industrywide security review.