• Shinhan
• KB Kookmin
• BNK Busan
• Hana

Four savings banks: 

• Yegaram
• Welcome
• DB
• OK

And other institutions such as credit finance organizations, online investment firms, electronic financial services providers, and cryptocurrency businesses. These include Hyundai Capital, KDB Capital, PFCT, Mouda, Brightfix, Streami, and Pravang. 

Five insitutions (DB Savings Bank, KDB Capital, Brightfix, Streami, and Pravang) were recently identified as exposure victims. 

Ram Varadarajan, CEO at Acalvio, comments, “The reach of this campaign, from major banks to crypto operators and payment firms, shows how an AI-assisted attacker can work through an entire sector at a speed that was previously reserved for a single target. The unfortunate reality is that defenses that rely on recognizing known-bad behavior will keep losing ground to adversaries that change their methods with every attempt; our current classifier defenses are only able to flag what they’ve already been taught to expect. 

“The mandate needs to be to use model-aware deception to change that calculation: decoy credentials and counterfeit systems that look authentic to a machine but have no legitimate business use turn the attacker’s own speed into the tripwire. Given the impacts on financial services, regulators and institutions are going to need to treat model-aware deception as a required layer behind perimeter and detection tools.” 

Patrick Harr, Chief Executive Officer at DataVisor, adds, “Organizations are under pressure to respond with more than point-in-time identity checks and static rules. Fraud is becoming polymorphic: attackers change identities, documents, devices, and behaviors faster than fixed defenses can adapt. The industry is moving from identity verification to continuous monitoring, combining a vast range of identity, device, behavioral, network, and transaction signals to detect changing fraud patterns in real time.

“The goal is to identify changing patterns early, stop the attack in real-time, before any loss occurs. Organizations should prepare for a broader, faster, and more adaptive fraud playbook instead of static identity verification.”

Leaked data includes names, email addresses, contact information, and resident registration numbers. 

“The cold truth is that the next breach disclosure is going to arrive faster than any cybersecurity signature update,” Varadarajan warns.