{"schema_version":"0.8.0","id":"LR-2026-0127","record_version":5,"title":"Shinhan Bank data breach with suspected AI-assisted intrusion","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":48.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":6.4,"unhedged_language":3.85},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true},"gate_version":"gate-2026-09-30.6","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-05","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-05","incident_class":"security_compromise","failure_class":null,"agent_involved":false,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Shinhan Bank said customer information was leaked after hackers gained access to its systems; the leaked information reportedly includes customers' names, phone numbers, loan borrowing details and annual income. Sources cited in reports said the attackers may have used advanced AI tools. South Korea's Financial Supervisory Service launched an emergency on-site inspection.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"moderate, because data or systems of others touched, with a bounded scope stated: Data of others (about 25,000 customers) was touched with a bounded scope stated: names, phone numbers, loan borrowing details and annual income.","harm_class":[],"affected_description":"about 25,000 customers in South Korea","protected_class_involved":null,"data_categories_exposed":["pii","financial"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thecyberexpress.com/shinhan-bank-cyberattack-exposes-data/","publisher":"news search (Google News index)","date":"2026-10-05","type":"press","title":"Shinhan Bank Cyberattack Exposes Data Of 25,000 Customers","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.adversarial_actor":"C","event.agent_involved":"D","event.incident_class":"C","event.summary":"C","event.date_disclosed":"A","event.trigger":"D","event.detection_method":"D","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity":"D","context.industry":"D","context.regulatory":"C","context.denominator_available":"D","context.country":"C","impact.severity_because":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"Sources cited in the reports said the attackers are suspected to be based overseas and may have used advanced AI tools during the attack."}],"event.adversarial_actor":[{"source_index":0,"quote":"Shinhan Bank said the information was leaked on Wednesday after hackers gained access to its systems."}],"event.incident_class":[{"source_index":0,"quote":"Shinhan Bank said the information was leaked on Wednesday after hackers gained access to its systems."}],"event.agent_involved":[{"source_index":0,"quote":"Sources cited in the reports said the attackers are suspected to be based overseas and may have used advanced AI tools during the attack."}],"impact.affected_description":[{"source_index":0,"quote":"The Shinhan Bank cyberattack has exposed personal and financial information belonging to about 25,000 customers in South Korea, with investigators examining whether advanced artificial intelligence tools were used to carry out the intrusion."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"The leaked information reportedly includes customers’ names, phone numbers, loan borrowing details and annual income."}],"impact.severity_because":[{"source_index":0,"quote":"The leaked information reportedly includes customers’ names, phone numbers, loan borrowing details and annual income."}],"context.country":[{"source_index":0,"quote":"The Shinhan Bank cyberattack has exposed personal and financial information belonging to about 25,000 customers in South Korea, with investigators examining whether advanced artificial intelligence tools were used to carry out the intrusion."}],"context.industry":[{"source_index":0,"quote":"Shinhan Bank said the information was leaked on Wednesday after hackers gained access to its systems."}],"context.regulatory":[{"source_index":0,"quote":"South Korea’s Financial Supervisory Service has launched an emergency on-site inspection as authorities investigate how the breach occurred and whether the suspected use of AI points to a wider risk for financial institutions."}],"impact.severity":[{"source_index":0,"quote":"The leaked information reportedly includes customers’ names, phone numbers, loan borrowing details and annual income."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-05"}],"event.summary":[{"source_index":0,"quote":"Shinhan Bank said the information was leaked on Wednesday after hackers gained access to its systems."},{"source_index":0,"quote":"The leaked information reportedly includes customers’ names, phone numbers, loan borrowing details and annual income."},{"source_index":0,"quote":"Sources cited in the reports said the attackers are suspected to be based overseas and may have used advanced AI tools during the attack."},{"source_index":0,"quote":"South Korea’s Financial Supervisory Service has launched an emergency on-site inspection as authorities investigate how the breach occurred and whether the suspected use of AI points to a wider risk for financial institutions."}]},"notes_on_gaps":"No source states the model family, version, harness, tools, permissions, autonomy level, guardrails, deployment context, lifecycle stage, integration type, intended use, safeguard state, production intent, date occurred, failure class, trigger, detection method, root cause, responsible party, input provenance, time to contain, operations paused, remediation, precursor events, direct loss, remediation hours, loss range, reversibility, downstream exposure, org size, denominator, systemic exposure, shared model id, upstream incident id, incident evidence, or coverage. The AI involvement is only suspected and no AI system is identified as the acting agent, so agent fields are left null or false and failure_class is null. event.trigger is omitted because no source states a cause. event.date_occurred is omitted because only the disclosure date is given. event.detection_method is unknown because no source says who first noticed. event.root_cause is unknown because no source names what failed. impact.severity is moderate because the breach touched data of about 25,000 customers with a bounded scope stated. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-09] system.developer: no source names the developer. system.autonomy_level: no source states the arrangement. system.deployment_context: no source states where it ran. event.agent_involved: classified from described behaviour. event.summary: classified from described behaviour. event.trigger: no source states a cause. event.detection_method: no source says who first noticed. context.industry: classified from described behaviour. context.denominator_available: no denominator is available for this incident. [corrected by Srini Iyer, approved 2026-10-18 in the corrections review: source gives a bound, not an exact count] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: linked to the records the matcher relates (same disclosure or summary)] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: citations to sentences about a different event were removed; summary or story described a different event or the article, not this event]"},"context":{"industry":"Finance and Insurance","org_size_band":null,"country":"KR","denominator_available":false,"denominator":null,"related_incident_ids":["LR-2026-0140"],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":{"regimes":[],"notifications":"South Korea’s Financial Supervisory Service has launched an emergency on-site inspection as authorities investigate how the breach occurred and whether the suspected use of AI points to a wider risk for financial institutions.","litigation_status":"unknown","safety_policy_adherence":null},"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Shinhan Bank was running its banking systems serving customers in South Korea; hackers gained access to those systems and leaked customer data.","quote":"Shinhan Bank said the information was leaked on Wednesday after hackers gained access to its systems.","source_index":0,"grade":"D"},{"step":"went_wrong","text":"Hackers gained access to the bank's systems and leaked personal and financial information of about 25,000 customers, breaching the bank's system boundary.","quote":"Shinhan Bank said the information was leaked on Wednesday after hackers gained access to its systems.","source_index":0,"grade":"D"},{"step":"reached","text":"Names, phone numbers, loan borrowing details and annual income of about 25,000 customers in South Korea were exposed.","quote":"The leaked information reportedly includes customers’ names, phone numbers, loan borrowing details and annual income.","source_index":0,"grade":"D"},{"step":"done","text":"The bank formed a response team, blocked external IP access, suspended affected services, and said it completed safety measures; the Financial Supervisory Service launched an on-site inspection.","quote":"These measures included blocking access from external IP addresses and suspending the affected services.","source_index":0,"grade":"D"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-09","source_urls":["https://thecyberexpress.com/shinhan-bank-cyberattack-exposes-data/"]}}