Bigger Security Budgets, Larger Breaches at Korea's Top 4 Banks
Shinhan Bank's 2025 leak hit about 25,000 customers, while Hana, the top budget executor, still reported 89 leaked accounts.
South Korea's four major banks spent more on information security in 2025 than in any previous year, yet the scale of recent hacking damage did not follow the size of their budgets, according to a comparison of autonomous disclosures and breach reports compiled by bloter.net.
Shinhan Bank, which ranked third in total security investment at 36.89841 billion won, suffered a personal data leak affecting about 25,000 customers in a hacking incident that bypassed identity verification on a mobile website for loan solicitors. KB Kookmin Bank, the largest spender at 43.32011 billion won, reported 119 customers' data leaked through unauthorized access to an employee mobile work-support system. Hana Bank, with 37.16715 billion won in investment, reported 89 customers affected after an intrusion into a sales-support system.
Woori Bank, the smallest investor of the four at 36.38143 billion won, blocked the unauthorized access attempt in its own systems, and no customer data leak from that attack has been confirmed so far.
Budget execution rates do not track with damage
Financial Supervisory Service data submitted to the National Assembly shows the four banks' 2025 information security budgets totaled 244.568 billion won, with 166.301 billion won executed — a 68.0% execution rate. Hana Bank executed 53.0017 billion won of its 53.002 billion won budget, effectively 100%, versus Shinhan Bank's 69.9%, KB Kookmin Bank's 58.1% and Woori Bank's 53.8%.
Information security budgets across the four banks rose from 209.343 billion won in 2023 to 235.858 billion won in 2024 and 244.568 billion won in 2025, a 16.8% increase over two years. Executed amounts rose only 8.0% over the same period, from 153.924 billion won to 166.301 billion won, and the execution rate fell for two consecutive years, from 73.5% in 2023 to 69.5% in 2024 and 68.0% in 2025.
Security staffing also varied. Dedicated information security staff numbered 101 at Woori Bank, 97.8 at Shinhan Bank, 96.7 at KB Kookmin Bank and 71.9 at Hana Bank, totaling 367.4 across the four banks. By investment share, information security accounted for 9.1% of Woori Bank's IT investment, 9.0% at Hana Bank, 8.15% at KB Kookmin Bank and 7.96% at Shinhan Bank.
Following the breaches, financial authorities ordered a full re-inspection of externally exposed IT systems, authentication and access control, and security vulnerabilities at an emergency meeting of financial institutions.
Quick answers
How many customers were affected by the recent bank data leaks?
Shinhan Bank's leak affected about 25,000 customers. KB Kookmin Bank reported 119 customers' data leaked and Hana Bank reported 89 customers affected. Woori Bank blocked the attempt and no customer data leak has been confirmed there so far.
How much did the four major banks spend on information security?
In 2025 their information security investment totaled 153.7671 billion won under autonomous disclosure, with KB Kookmin Bank at 43.32011 billion won, Hana Bank 37.16715 billion won, Shinhan Bank 36.89841 billion won and Woori Bank 36.38143 billion won.
What did financial authorities order after the hacking incidents?
At an emergency meeting of financial institutions, authorities ordered a full re-inspection of externally exposed IT systems, authentication and access control, and security vulnerabilities.