OK Savings Bank’s personal data leak has expanded from loan applicants to customers using receiving services such as deposits. After confirming a leak involving 250 loan applicants, it also found that information on 268 receiving-service users was additionally leaked. The leaked information this time included not only account numbers but also financial product names, deposit balances and interest rates.

OK Savings Bank said on Oct. 16 it additionally confirmed the personal data leak involving 268 customers using its mobile receiving services while conducting a detailed, system-wide investigation in connection with the abnormal access incident on its website.

The additional leak occurred on a page related to mobile receiving services that is separate from the existing loan application webpage. OK Savings Bank said there were abnormal access attempts from 3:32 a.m. to 7:34 a.m. on Oct. 15, and an investigation confirmed a leak of customer information.

The additionally leaked items were receiving-service related information such as customers’ names, account numbers, product names, balances, interest rates and the last transaction date.

Earlier, OK Savings Bank announced that personal information of 250 customers was leaked due to abnormal access to its loan application webpage that occurred from Oct. 11 to Oct. 12. The leaked items at the time included names, dates of birth, mobile phone numbers, account numbers, addresses, annual income and loan amounts.

With this additional confirmation, the number of affected customers disclosed by the company totals 518, including 250 loan applicants and 268 receiving-service customers.

OK Savings Bank said that after it first became aware of the initial incident on Oct. 12, it blocked suspicious IP addresses and access routes and has carried out a detailed, system-wide investigation across services including receiving and banking.

On Oct. 15, when it confirmed signs of an additional breach, it confirmed the data leak at 10 a.m. and blocked suspicious IP addresses and access routes at 10:59 a.m. It then urgently applied defensive logic for its account inquiry service at 1:52 p.m., and added common defensive logic for session management at 5:10 p.m. At 8 p.m., it applied a solution to detect and block abnormal activity.

At 9:55 p.m. the same day, it completed a report to the Financial Supervisory Service on its response to an electronic financial accident. It also completed individual notifications to customers affected by the additional leak at 8:52 a.m. on Oct. 16.

OK Savings Bank said it informed customers of the leak and how to prevent secondary 피해 via text messages and email, and plans to support damage reports and complaint consultations.

An OK Savings Bank official said, "After recognizing the initial leak status, we completed an emergency response, but during a recheck process of the overall system we confirmed an additional leak." The official said, "We deeply apologize again for causing concern."