SEOUL, November 3, 2026 — South Korean police have opened a preliminary investigation into the online leak of personal information belonging to 168 people who traveled aboard the presidential aircraft during a June trip to Europe, a list that includes President Lee Jae Myung, the first lady and Cabinet ministers, according to the Korea Herald. The foreign ministry said it is taking steps to reissue the passports of the president and first lady.
The breach lands in the middle of a broader run of cyberattacks on South Korean banks, telecom operators, businesses and government agencies. Figures compiled by the Financial Services Commission (FSC) show the financial sector alone has absorbed incidents at 16 firms affecting roughly 100,000 customer records, and the presidential manifest leak has pushed the question of how government agencies handle sensitive information to the top of the agenda.
Emergency Inspections Across 2,100 Agencies
The National Intelligence Service (NIS) said Tuesday it will launch emergency security inspections at some 2,100 government agencies nationwide, including central government ministries and local governments. The spy agency also plans direct security checks on critical public information and communications infrastructure under its oversight, with the inspections expected to be completed by mid-November.
The scope is the tell. A 2,100-agency sweep is not a targeted audit of one compromised server; it is a census of the government’s attack surface, run on a deadline of roughly two weeks. For an economy that runs payroll, banking and identity verification through shared online rails, the results of those checks will matter well beyond the ministries themselves.
Financial Sector Losses Mount
The financial sector has taken the heaviest documented hits. On Oct. 14, the FSC confirmed cybersecurity incidents at 16 financial firms, a group that included commercial banks, savings banks and credit finance companies, affecting approximately 100,000 customer records.
Concerns deepened on Oct. 28, when Daishin Securities, Mirae Asset Global Investments and cryptocurrency exchange Bithumb reported separate incidents involving customer information. According to TechCrunch, Daishin reported a cyberattack that exposed the personal information of 38,490 customers, including names, email addresses and mobile phone numbers. The company has notified affected customers, is cooperating with authorities and will compensate for any losses as required by law. Mirae and Bithumb reported separate incidents the same day, though neither has confirmed that customer data was taken.
Security researchers linked the September wave of attacks on South Korea to a suspected China-based hacker who relied on an AI penetration testing tool called Artex, TechCrunch reported, though officials are still investigating the root cause of the latest breaches. Investigators have not established a connection between the Korean incidents and a cybersecurity incident Japan reported yesterday involving GMO Internet, which followed a series of attacks on Japanese financial institutions.
Why the Supply Chain Is Exposed
The risk profile here is structural, not incidental. South Korea’s financial institutions and businesses lean heavily on shared networks and online services, so a breach at a telecom operator can expose customer information used for banking and other online services, while an attack on a major cloud provider can disrupt multiple businesses at once. The same logic reaches the country’s key manufacturing industries, including semiconductors, automobiles and shipbuilding, which increasingly run on connected factories and automated production systems.
That is the difference between a data-theft problem and an operational one. A stolen customer record is a liability for the firm that held it. A compromised production network at a chip fab or an assembly line is a delivery problem for every buyer downstream, and South Korean manufacturers sit near the center of global electronics supply chains. The scale and frequency of the breaches have raised concerns that cyber threats could extend beyond personal data theft to disrupt financial services, business operations and industrial supply chains.
Warning Level Raised as AI Reshapes the Threat
The government has already moved its dials. Last month, the Ministry of Science and ICT raised the country’s cyber crisis warning level by one notch to “caution,” the second lowest in its four-tier system, amid global efforts to address two critical security flaws in PHP, a widely used programming language. The financial regulator has called for stronger cybersecurity measures following the string of attacks on financial firms and government agencies, and the country plans to conduct security checks on dozens of IT systems in the private sector.
The common thread across the recent incidents is automation on the attacker’s side. Hackers are increasingly turning to AI tools to find security weaknesses and launch attacks against multiple targets, which shortens the gap between discovering a flaw and exploiting it at scale. The Artex tool named by researchers fits that pattern: penetration testing software, the kind of utility a security team uses to harden a network, repurposed to break into one.
For ordinary users, the practical exposure is identity data that cannot be reissued as easily as a passport. Names, email addresses and mobile phone numbers are the raw material for phishing and account takeover, and they are shared across banking, telecom and retail logins. The presidential passport reissue is a contained fix; the 100,000 customer records confirmed by the FSC are not.
The NIS inspections are due to be completed by mid-November.
Sources
- Wave of cyber breaches exposes growing risks to S. Korea's digital economy
- (News Focus) Wave of cyber breaches exposes growing risks to S. Korea's digital economy | Yonhap News Agency
- Wave of cyber breaches exposes growing risks to Korea's digital economy – The Korea Times
- Wave of cyber breaches exposes growing risks to Korea's digital economy – The Korea Times
- South Korea's financial industry hit by fresh wave of cyberattacks | TechCrunch
Photo: User:G43 (CC BY 3.0)
