Shinhan Bank Exposed Loan Customer Info on Website... Breached by Random Hacking

It has been reported that the customer information leaked from Shinhan Bank consisted of loan consultation details entered onto the website server by loan brokers.

Critics point out that the fatal flaw was storing sensitive customer information in a place where loan brokers could easily access it simply by entering an ID and password.

Shinhan Bank CEO Jung Sang-hyuk stated in an apology posted on the website today, "We have confirmed that an unauthorized external party leaked customer information from some services through abnormal methods."

The leaked information includes customer names, phone numbers, annual incomes, and loan limits, along with 66 resident registration numbers and 97 connecting information (CI) items for some customers.

The number of affected customers reaches approximately 25,000.

According to the bank's explanation, unlike other banks, Shinhan Bank loan brokers can easily check the processing status of the loans they have received through the mobile version of the website, "M-Shinhan," and the information was leaked as the IDs and passwords of these brokers were compromised.

In response, both inside and outside the banking sector, criticism has been raised that storing a large amount of customer information on a server that outsiders can access without formal login procedures such as official certificates exposed the bank's financial security vulnerabilities.

Another problem pointed out is that abnormal signs, such as repeated login attempts across multiple accounts, login failures, or abnormal IPs, were not properly detected.

However, Shinhan Bank emphasized that applications directly used by customers, such as "Shinhan Super SOL," are unrelated to this incident.

The Financial Services Commission and the Financial Supervisory Service convened an emergency response meeting this morning, and the Financial Security Institute has been on-site since yesterday investigating the cause of the incident.

It is expected to take several months until the final investigation results are announced.

Shinhan Bank has formed an emergency countermeasures committee and is operating a company-wide emergency response system.

The bank also reported that emergency measures, such as blocking external IPs, suspending related services, and applying new security policies, have been completed.

(Photo: Yonhap News)
※ Please note: This article was translated by AI and may contain errors.