Scale of the breach: 16 institutions and roughly 100,000 records
Security reports describe an AI-assisted hacking campaign that has hit 16 financial institutions and leaked approximately 100,000 personal records. The affected organizations span multiple categories of financial services, and reporting identifies the total known count of impacted firms as 16.
Named institutions: four banks, four savings banks, and a range of fintech and crypto firms
Publicly named victims in the breach include four banks and four savings banks, plus credit finance organizations, online investment firms, electronic financial services providers, and cryptocurrency businesses. The firms listed in reporting are:
- Banks: Shinhan; KB Kookmin; BNK Busan; Hana
- Savings banks: Yegaram; Welcome; DB; OK
- Other named entities: Hyundai Capital; KDB Capital; PFCT; Mouda; Brightfix; Streami; Pravang
Five institutions were recently identified specifically as exposure victims: DB Savings Bank, KDB Capital, Brightfix, Streami, and Pravang.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildLeaked data: personal identifiers and contact information
The breached data set, as reported, contains names, email addresses, contact information, and resident registration numbers. Those categories are the only types of data explicitly listed in the reporting; no dollar amounts, account balances, or other financial records are identified in the source material.
Expert prescriptions: model-aware deception and continuous monitoring
Two security executives quoted in the reporting described differing but complementary defenses for an environment they say is changing because of AI-enabled attacks.
Ram Varadarajan, CEO at Acalvio, argued that defenses based on recognizing known-bad behavior will fall behind attackers who change methods. He recommended "model-aware deception"—that is, "decoy credentials and counterfeit systems that look authentic to a machine but have no legitimate business use"—as an additional layer behind perimeter and detection tools, writing that such deception would "turn the attacker’s own speed into the tripwire."
Patrick Harr, Chief Executive Officer at DataVisor, emphasized a shift from static identity checks to "continuous monitoring," combining identity, device, behavioral, network, and transaction signals to detect rapidly changing fraud patterns. Harr said the goal is "to identify changing patterns early, stop the attack in real-time, before any loss occurs," and urged preparation for "a broader, faster, and more adaptive fraud playbook instead of static identity verification."
What this means for regulators, affected enterprises, and end users
- Regulators: The reporting quotes Varadarajan suggesting regulators and institutions will need to "treat model-aware deception as a required layer" behind existing perimeter and detection tools.
- Affected enterprises and procurement leaders: The incident highlights a push—per Harr—toward continuous monitoring that fuses many signal types (identity, device, behavioral, network, transaction) rather than relying solely on static rules and point-in-time checks.
- End users and customers: The leaked fields (names, email addresses, contact information, resident registration numbers) are the specific categories named; customers associated with the affected firms should expect notifications from those organizations and take any institutionally recommended steps to protect exposed identifiers.
Two themes run clearly through the available reporting: the breadth of the campaign across different categories of financial firms, and industry calls to add adaptive, model-aware defensive layers to complement existing detection systems. As Varadarajan put it bluntly, "The cold truth is that the next breach disclosure is going to arrive faster than any cybersecurity signature update."
