Sixteen Korean Firms, Then Three More: The Second Breach Wave Bypassed Bank Cores and Landed on Opex, Insurance and Ratings

Three more Korean financial firms disclosed customer-data breaches on Oct. 28, 2026, four weeks after the first wave closed: Daishin Securities said 38,490 customers' data was taken after signs of unauthorized access, Bithumb confirmed some customer information was stolen by an outside party, and authorities opened an inspection into Mirae Asset Global Investments, part of Mirae Asset Securities. Regulators had already confirmed breaches at 16 firms and about 100,000 leaked records on Oct. 14 and have said the count can still rise. Every disclosed entry point stopped at the edge of the bank: loan-agent inquiry portals, employee mobile work-support systems and sales-support screens.

Data type matters more than volume here. Shinhan Financial Group's Shinhan Bank disclosure covered names, phone numbers, annual incomes and calculated borrowing limits for roughly 25,000 people — a fraud-ready dataset, not a mailing list. BNK Financial Group's BNK Busan Bank exposed data on 11 outsourced developers because web pages lacked session validation. Regulators confirmed they found no leaked password or card number usable for direct fraudulent payment, which is why the damage so far shows up as notification, remediation and supervisory risk rather than as a payments event.

Cyber that stays outside the core still has to be paid for. The bills are remediation, customer notification, statutory fines and, in Japan, cash compensation — and almost none of them is insured, because insurers cover roughly 1% of global economic cyber losses. A bank whose peripheral systems are breached therefore pays for the response itself, which is why the Korean version of that bill is already showing up in security budgets rather than in provisioning.

KB Kookmin Bank spent ₩86.08B on information security in 2026 and will lift the line above ₩100B in 2027, at least 16% higher. Shinhan Bank cut its 2026 information-security budget 10.4% to ₩40.59B — 9.1% of its IT budget — in the year it disclosed the largest bank-side breach of the wave. Scaled against earnings the step-up is trivial: ₩100B is about 1.7% of KB Financial Group's ₩5.85T of FY2025 net income, and Shinhan's entire 2026 security line was 0.8% of its ₩4.97T.

US cyber claims grew 20% in 2025 while direct written premium grew 3.5%, and the industry loss ratio deteriorated from 48.7 to 53 while policies in force grew 33% to 5.84M. Prices have not followed: brokers reported cyber rates down 3.2% in Q2 2026, a ninth consecutive quarterly decline, and US cyber pricing was flat in Q3 2026 after 13 straight quarters of global decreases. Capacity is being added into a market whose loss ratio is getting worse.

Insurance covers roughly 1% of global economic cyber losses, so a bank with a peripheral breach funds the response itself; the policy exists for the tail that never appears in a 100,000-record count. That is the line quietly repricing. US financial and professional lines rates rose 1% in Q3 2026 even as the composite index fell 1% and broad cyber pricing went flat. The insurers on the other side of that trade are being asked to hold capacity into a worse loss ratio, and a carrier such as Chubb, which reported FY2025 net income of $10.3B on $59.8B of revenue, enters that stretch with a balance sheet that can absorb it.

One operator, an open-source agentic pen-testing tool and commercial LLMs — DeepSeek v4.1-flash as the primary backend, with GLM-5.3 from Z.AI and Grok 4.6 in additional sessions — collapsed the cost of attacking a bank's edge. The run against Shinhan's loan-inquiry portal lasted about 30 hours and beat mobile verification by feeding in random customer numbers; Korean police believe the suspect is a 26-year-old based in Guangdong.

The defense regulators now demand is unglamorous: keep phishing-resistant MFA and asset inventories current, map which third parties can reach which systems, and treat a referral network as an extension of the bank. That is the Federal Reserve's own line — Vice Chair for Supervision Michelle Bowman points to cyber hygiene, phishing-resistant multifactor authentication, strong identity and access control, and up-to-date asset inventories — and it is how the 2023 interagency third-party guidance already treats referral arrangements, with the message that relying on a third party does not dilute the bank's responsibility. US supervisors moved in the same window, issuing a joint statement in July 2026 on handling highly sensitive customer information during examinations, and proposing updates to the interagency third-party guidance and a joint statement on core service providers.

For scale, JPMorgan Chase reported FY2025 revenue of $279.7B and net income of $57.0B; an event of this size at that scale cannot move a US bank's earnings — unless it scales into something correlated. That is where the ratings channel bites. Fitch says the Korean incidents are unlikely to change rated Korean banks' credit profiles but will bring heavier regulatory scrutiny and higher costs, and Korea Ratings has already cut Lotte Card's risk-management factor after a breach affecting about 2.97 million customers, echoing the logic that took Bank of Valletta to BBB- from BBB in 2019.

Over one to three years, attack tooling keeps getting cheaper while security budgets stay sticky: agentic pen-testing that needed no exotic exploit in Seoul works just as well against a US bank's referral portal, so the marginal cost of testing a perimeter approaches the cost of an API call. The offsetting force is the one Korean regulators just invoked — asset inventories, identity hygiene and third-party access maps are exactly the controls that would have stopped a 30-hour credential run, and they are also what US examiners now ask for.

The thesis is narrow and testable: cyber at banks is now an operating-cost and insurance story with a credit tail, not a market event. Three observations would break it. A breach of a Korean core ledger or payment rail would make this a systemic-risk event. A US bank disclosing an intrusion through its referral or outsourced-servicing network would move the cost from trivia to guidance. And a US cyber loss ratio above roughly 55% with financial-lines rates accelerating would confirm that severity is finally being priced.