Shinhan Bank

Shinhan Bank's "M Shinhan" loan-inquiry site let an outsider bypass authentication and exploit a code flaw on September 29 and 30, 2026, exposing names, phone numbers, incomes, and loan limits for about 25,000 customers, including 66 resident registration numbers and 97 CI records. The bank calls it an AI-driven brute-force attack, its own characterization. A public loan-inquiry page was serving as the authentication boundary for sensitive financial data, scripted guessing isn't brute-force or sophisticated. It's jiggling door handles to see if any of them are unlocked.