SecurityHeroblog
Security Basics7views

Shinhan Bank Loan Data Leak: The More the Caller Knows Your Income, the More You Should Hang Up and Call Back

Reports say the names, phone numbers, annual incomes, and loan limits of roughly 25,000 people who inquired about loans at Shinhan Bank have leaked. The fact that a caller knows your information precisely is not proof that they work at the bank. Here are the two things to do now, and what we still don't know.

The Voice on the Other Side of the Intercom

Your apartment intercom buzzes in the evening.

“Is this Mr./Ms. Kim in unit 302? This is the management office. Your maintenance fee last month came to ○○0,000 won, and there’s something we need to settle. Could you open the door for a moment?”

The name is right. The unit number is right. Even the maintenance fee amount is right. At this point, most people open the door.

But let’s change one thing. What if the entire stack of that month’s maintenance fee bills had leaked out of the building? Anyone holding those bills could say exactly the same thing. Knowing your name and your bill amount is no longer proof that someone works at the management office.

Today came reports that this kind of “bill” leaked from Shinhan Bank.

What Leaked

FACT Reports say that loan-related customer information leaked out of Shinhan Bank. The scale the bank has stated is about 25,000 people.

FACT The items that leaked were reported as follows.

Item In plain terms
Name They can address you by name
Phone number They can call you
CI (Connecting Information) A per-person identifier used to check whether “this is the same person” across multiple services
Annual income How much you earn in a year
Calculated loan limit The “you can borrow up to this much” amount the bank worked out for you

Those affected are people who used Shinhan Bank’s web service for a quick loan-limit check, or who applied for or consulted about a loan — specifically, those the bank has confirmed as affected by the leak.

FACT Reports say the ordinary internet and mobile banking that customers log into was not breached. That means this is not an incident where your account balance or transfer screens were handed over.

Back to the intercom analogy: your front door key was not stolen. The maintenance fee bills leaked. The door is still locked. It’s just that someone outside can now pretend to know you very well.

So What Kind of Call Might Come

INFERRED What follows is the scenario we worry about. As of today, there have been no reports that calls like this have actually been made.

A call comes from a number you don’t know. They say they’re the “Shinhan Bank loan consulting team.” They address you by name. They state the exact loan limit you checked earlier. Then they continue: “You can refinance at a lower rate. To do that, first install this app.” Or, “You need to pay off your existing loan to this account first.”

INFERRED What makes this scenario frightening is that it sounds like there isn’t a single lie mixed in. Name, phone number, income, limit. All four are real. When someone says several correct things about you, you come to trust them. It’s the same as opening the door after hearing your maintenance fee amount over the intercom.

Why It Works — And Where It Breaks Down

FACT A real bank does not tell you to install an app over the phone or by text message. Nor does it tell you to pay off an existing loan into a personal account.

This is the crux. How much the other party knows now proves nothing. On the day the bills leaked, someone who can recite the contents of the bill may be more suspicious, not less.

So what should you look at? Who placed the call. When the intercom buzzes, instead of opening the door, you can call the management office yourself. You already know the management office’s number. The person who answers a call you placed to that number is the real thing.

How It Leaked

FACT Reports say credential stuffing has been raised as the attack method. However, it has not been confirmed.

Credential stuffing, in plain terms, works like this. You take IDs and passwords that have already leaked from other sites. You try them one by one on this site and that site. Because many people reuse the same password in multiple places, some of them open.

FACT Reports differ in how they describe where the leak occurred. Some reports say a “web-based quick loan inquiry service.” Other reports say a “separate business system used by loan brokers.” Loan brokers are people who bring in loan customers on behalf of the bank.

INFERRED If it was credential stuffing, the starting point of the problem may be outside Shinhan Bank. It would mean a password stolen somewhere else was used as the key here. That’s why passwords are on the to-do list. Whose account was used (a customer’s or a loan broker’s) is still not known.

The Scale in Numbers

Only two numbers have been reported in this incident. Comparing them to each other shows what they mean.

Number When/who Meaning
Around 20,000 records Initial reports The scale first made known
About 25,000 people Per the bank’s announcement Those confirmed affected so far. Reported as possibly increasing as the investigation proceeds

FACT The number already grew once within the same day. The bank’s announcement is about 5,000 people higher than the initial reports. And it said the figure could grow further. The current number is best read not as a final figure but as an interim count.

INFERRED Keep one distinction firmly in mind. The 25,000 is the number of people whose information left the bank. It is not the number of people who lost money. There are no reports of damages yet. It means 25,000 households had their bills leak — not that 25,000 doors were opened.

What the Bank and the Authorities Did

FACT According to reports, the bank became aware of the leak on September 30. The Financial Supervisory Service launched an emergency on-site investigation. The Financial Services Commission and the FSS held a meeting on October 1.

FACT The bank stated that it blocked external IPs, halted the service in question, and applied a new security policy. An IP is an address used on the internet. It means they blocked the addresses the problematic connections were coming from.

FACT Shinhan Bank President Jung Sang-hyuk apologized. Reports say he pledged to fully compensate any customer losses arising from the leak.

What To Do Now

If you have ever checked a loan limit or looked into a loan at Shinhan Bank, you may be among the 25,000. Until that’s confirmed, it’s better to act as though you are.

1. If a call comes about loans, hang up first. Then call back yourself, through the Shinhan Bank app or the official main number. When the intercom buzzes, you pick up the phone to the management office instead of opening the door. This holds even if the caller states your name, income, and limit exactly. In fact, all the more so if they do.

2. If your password for bank or financial sites is the same as on other sites, change it now. The method raised in this case is “trying passwords stolen somewhere else.” As long as you reuse the same password, a leak at another site follows you right up to your bank’s front door.

There is one standard to remember. Trust only the call you placed, not the call that came in.

What We Don’t Know

Below are the things that are unconfirmed as of today (October 1). We do not fill these in with guesses.

  • Whether it has actually been used for fraud. There are no reports yet that the leaked information has been used in loan fraud or voice phishing, nor any warning from the authorities. The phone scenario above is a concern.
  • Whether resident registration numbers were included. There is a report that resident registration numbers were “held” in the system in question. But the reports listing the leaked items do not include resident registration numbers. We say neither that they were included nor that they were not.
  • Where the breach happened. Whether it was the loan brokers’ business system or the customer-facing quick inquiry service differs from report to report.
  • Whose account was used. If it was credential stuffing, whether it was a customer’s account or a loan broker’s account is not known. The method itself is also not yet confirmed.
  • When it started and when it ended. The period during which the leak occurred is not known.
  • Whether you will be contacted. Whether individual notifications will go to victims, and if so when and by what means, is not known.
  • How to receive compensation. The specific method and application procedure for “full compensation” have not been published.
  • Whether the scale is final. Two numbers have been reported: around 20,000 records and about 25,000 people. The figure may grow depending on the results of the investigation.
  • Who carried out the attack. There are no reports on who did this. We do not speculate either.

This post was written solely on the basis of press reports. We were unable to verify primary sources such as the original Shinhan Bank notice or press releases from the financial authorities. The scale of the leak, the route, and whether resident registration numbers were included are inconsistent across reports, and no cases of fraudulent misuse have been confirmed.

Sources

We were unable to obtain primary sources (the original Shinhan Bank notice and apology, press releases from the Financial Supervisory Service and the Financial Services Commission). All of the below are press reports.

As of 2026-10-01. This post is a news piece reorganizing press reports, not our own honeypot observations. That is why there are no attack timeline, MITRE, or IOC blocks and no IP or credential citations. We did not reproduce sentences from the articles; we rewrote only the facts in our own words. For numbers, we used only the two values that were reported. The phone scenario is a concern we inferred from the leaked items, not a reported case.