20 Korean banks found 4,777 valid vulnerabilities in 481 penetration tests from 2022 to August 2026, and 109 of them were still unpatched as of August 2026. The data was submitted by the Financial Supervisory Service (FSS) to the office of Rep. Park Sang-hyuk of the National Assembly’s National Policy Committee.

Over the same period, major banks’ information security investment actually fell. Because the figures came out after the serial financial-sector hacks that began on September 30, they became an issue the heads of the five major commercial banks must answer in person at the October 19 parliamentary audit of the FSS.

Concept image of checking bank systems for vulnerabilities Concept image of checking bank systems for vulnerabilities — Source: concept image · self-generated with agy

Overview of the data and the yearly trend

A penetration test is a check in which a bank has outside experts or its internal security team attack its systems like a real attacker to find vulnerabilities. Valid vulnerabilities count only those judged to be actually exploitable.

Bar chart of valid vulnerabilities found in penetration tests at 20 banks, 2022 to August 2026 Bar chart of valid vulnerabilities found in penetration tests at 20 banks, 2022 to August 2026 — Source: self-rendered from reports on the FSS submission

By year, they rose from 683 in 2022 and 785 in 2023 to 1,071 in 2024 and 1,286 in 2025, and there were 952 in 2026 through August alone. 2025 is 1.9 times 2022.

The number of tests rose too, so the figures need careful reading. Penetration tests rose 13.1% from 107 in 2024 to 121 in 2025, while vulnerabilities rose 20.1% over the same period, faster than the test count. Testing more often and more deeply turns up more vulnerabilities, so a rise in vulnerability counts alone doesn’t establish that banks’ security has worsened.

  • Scope: 20 Korean banks (per-bank figures not disclosed)
  • Period: January 2022 – August 2026
  • 481 penetration tests, 4,777 valid vulnerabilities, 4,668 patched
  • Some outlets reported 4,770; the original FSS submission hasn’t been published

Breakdown of the 109 unpatched vulnerabilities

Of the 109 unpatched, 106 were found in 2026. The rest are 2 found in 2024 and 1 found in 2025.

Bar chart of the 109 unpatched vulnerabilities by year found Bar chart of the 109 unpatched vulnerabilities by year found — Source: self-rendered from reports on the FSS submission

The 106 found in 2026 are what remains after fixing 846 of 952, so given the time it takes to patch after discovery, many can be seen as measures in progress. The main issue is the 3 not patched by the following year. Rep. Park pointed out that one specialized bank still hasn’t patched a vulnerability found in 2024, citing system aging.

The FSS explained that patching these vulnerabilities requires shutting down or fully replacing systems, making immediate action difficult. It said that until they’re patched, banks are responding by registering block rules on security equipment or strengthening monitoring. Instead of fixing the vulnerability itself, it’s a temporary control that blocks attacks exploiting it at the security equipment.

Item Disclosed
Total and yearly counts Disclosed
Year found for the 109 unpatched Disclosed
Names of banks with the vulnerabilities Not disclosed
Vulnerability types and severity Not disclosed
Planned patch completion dates Not disclosed

Shrinking information security investment

While vulnerability counts rose, investment fell. Combined information security investment at the three banks that filed information security disclosures two years running — KB Kookmin, Shinhan, and Woori — fell 5.9%, from about ₩123.95 billion in 2024 to ₩116.6 billion in 2025.

Combined information security investment at KB Kookmin, Shinhan, and Woori, 2024 versus 2025 Combined information security investment at KB Kookmin, Shinhan, and Woori, 2024 versus 2025 — Source: self-rendered from reports on each bank’s information security disclosure

Of the three, KB Kookmin increased while Shinhan and Woori decreased. The share of information security in IT investment at the same three banks also fell from 9.14% to 8.35%. Banks explain that large system upgrades don’t happen every year, so investment can fluctuate from year to year.

Bank 2025 information security investment (₩100 million)
KB Kookmin Bank 433.2
Hana Bank 371.7
Shinhan Bank 369.0
Woori Bank 363.8

Hana Bank first disclosed in 2026 and was excluded from the year-over-year comparison, and NH NongHyup Bank hasn’t joined the disclosures yet. Other tallies point the same way. The five major commercial banks’ 2025 information security investment, released by Rep. Kim Jae-seop’s office using FSS data, was ₩214.428 billion, down 2.4% from the previous year. The banks covered and the counting criteria differ, so the two decline rates are separate figures. Over the same period, the banking sector’s interest income rose from ₩55.9 trillion in 2022 to ₩60.4 trillion in 2025.

Connection to the serial hacks

The breaches confirmed since September 30 at Shinhan, KB Kookmin, Hana Bank, and others happened not in customer internet banking but in externally exposed business systems used by loan brokers and staff. At Shinhan Bank, information was reported to have leaked through a broker-only loan status lookup service by plugging in lookup values at random.

Seven Korean Financial Firms Breached in a Row — The Entry Point Was Staff-Facing Systems

However, whether the flaws in the breached systems were among the 109 unpatched hasn’t been confirmed, because which banks’ systems the 109 belong to hasn’t been disclosed.

Gauge of 9 AI-assisted penetration tests out of 481 in the banking sector Gauge of 9 AI-assisted penetration tests out of 481 in the banking sector — Source: self-rendered from reports on Rep. Park Sang-hyuk’s office data

While there are estimates that AI-based automation was used in some of these attacks, the banking sector ran only 9 AI-assisted penetration tests over the same period, and related checks only started in 2026. Attacks that automatically vary the values of countless requests scan a far wider range than checks people perform by hand, so if the scope and method of checks stay the same, attackers can find vulnerabilities before the banks do.

ARTEX AI — The Autonomous Pentest Tool That Left Traces in the Serial Bank Hacks

Issues for the October 19 audit, and what to do

At a plenary meeting on October 8, the National Assembly’s National Policy Committee added KB Kookmin Bank CEO Lee Hwan-ju, Shinhan Bank CEO Jung Sang-hyuk, Hana Bank CEO Lee Ho-sung, Woori Bank CEO Jung Jin-wan, and NH NongHyup Bank CEO Kang Tae-young as witnesses for the October 19 FSS audit. It’s the first time in four years, since 2022, that all five major commercial bank heads appear as audit witnesses at once.

Article 21-3 of the Electronic Financial Transactions Act requires financial companies to analyze and assess vulnerabilities in their electronic financial infrastructure every year and to draw up and carry out remediation plans based on the results. Whether the 481 penetration tests in this data cover the same scope as this statutory check can’t be confirmed from public material.

  • The banks and systems behind the 3 not patched by the following year, and their planned completion dates
  • Whether the block rules applied during the unpatched period could have stopped this type of attack
  • Whether externally exposed systems for loan brokers and staff were within penetration test scope
  • Banks’ explanation of the gap between falling security investment and rising interest income

Summary card of what customers and banks should do Summary card of what customers and banks should do — Source: self-rendered from Financial Services Commission and KISA guidance

🔗 Link - https://isds.kisa.or.kr

If you suspect harm, report it to the FSS at 1332 or KISA at 118.

Sources