East Asian cyberattacks compromise over 16 million accounts

Intrusions hitting South Korean lenders and Japanese consumer platforms reveal automated penetration tools outpacing corporate defenses across the region.

Corporate networks across Japan and South Korea have suffered a wave of coordinated digital breaches, exposing millions of customer records and accelerating concerns that automated software tools are altering the speed of corporate intrusions.¹²³

In South Korea, financial authorities confirmed unauthorized intrusions across nine lending institutions, beginning with an infiltration into an external loan-broker inquiry system at Shinhan Bank on September 29.³ By early October, the Financial Supervisory Service identified 19 suspicious internet protocol addresses routed across 12 jurisdictions, including the United States, Japan, Hong Kong, Singapore, and Vietnam.³ Investigators at the Financial Security Institute discovered traces of ARTEX, an open-source penetration-testing utility documented in Chinese and distributed publicly on GitHub, embedded in the server logs tied to the bank breach.³ The tool automates reconnaissance and vulnerability discovery, collapsing investigative steps that historically required days of manual reconnaissance.³

The breach at Shinhan Bank compromised the personal records of roughly 25,700 borrowers, including annual income figures, phone numbers, and loan ceilings.³ Similar intrusions compromised approximately 40,000 customer accounts at Yegaram Savings Bank, alongside smaller exposures at KB Kookmin Bank and Hana Bank.³ While Woori Bank and NH Nonghyup Bank successfully repelled matching connection requests, national police deployed 28 dedicated investigators to trace the intrusion pathways.³

Parallel disruptions across Japan exposed consumer information on a far broader scale. Monogatari Corporation reported that an unauthorized intrusion into the membership management infrastructure supporting its Yakiniku King restaurant franchise compromised more than 10 million user records.⁴²⁵ The compromised data included customer email addresses and telephone numbers registered through its smartphone reservation and rewards platform.⁴ Days earlier, car-sharing operator Park24 disclosed that an intrusion into its Times Car network compromised data belonging to 6.6 million accounts.⁵²⁶

Security researchers tracking the Japanese incidents recorded a sharp jump in web and application vulnerabilities. At security firm Macnica, researchers logged an increase in suspected application exploits from a monthly average of six during the first half of 2026 to 23 per month beginning in July.² Sejiyama Yutaka of Macnica's Security Research Center pointed to machine-learning utilities as the primary driver behind the surge, noting that automated tools now scan for obscure, bespoke flaws at operational tempos that outstrip human administration.²

The breach pattern has not spared securities brokerages or retail platforms. Daiwa Securities Group disclosed that an unauthorized breach of an external contractor server compromised information associated with roughly 110,000 brokerage clients.⁴²⁶ Retailer Mr. Max Holdings reported that unauthorized access to its online shopping server exposed records for up to 1.7 million customers, prompting the company to suspend services and isolate connection routes.⁴ Online research vendor GMO Research confirmed that unauthorized access compromised up to 948,498 accounts, with attackers illicitly converting accumulated loyalty points into approximately 2.9 million yen in commercial gift vouchers across 611 customer accounts.⁵⁴

Academic specialists warned that stolen contact profiles provide immediate leverage for secondary fraud. Uehara Tetsutaro, an information security professor at Ritsumeikan University, noted that exposed contact details routinely circulate on illicit marketplaces, where attackers feed personal identifiers into automated phishing pipelines and fraudulent loan applications. In response, Japanese government officials, including Chief Cabinet Secretary Minoru Kihara and Digital Transformation Minister Furukawa Toshiharu, urged corporations to enforce multifactor authentication and eliminate credential reuse across enterprise networks.⁵

Corporate incident response teams now confront an acute structural bottleneck. A survey of more than 950 domestic firms published by the Japan Users Association of Information Systems found that 78.4 percent of companies with annual sales between 100 billion yen and 1 trillion yen suffer from a direct shortage of cybersecurity personnel.² For enterprises generating more than 1 trillion yen in revenue, 74.5 percent reported identical operational staffing deficits.²

Global threat tracking mirrors the operational shift observed in Seoul and Tokyo. Annual threat metrics compiled by CrowdStrike documented an 89 percent jump in machine-assisted intrusions, while the average breakout time required for an attacker to move laterally across an internal network contracted to 29 minutes.³ As enterprise defenders struggle to patch legacy software endpoints, defensive technical adoption remains behind the operational curve. An industry specialist at Google warned that corporate executives misunderstand the competitive timeline, noting that "the reality is that it's already begun."¹

What this rests on

21 sentences trace to 6 sources.

All 6Documents 1Records 0Reporting 5People 0

1. 1 JG Jeronimo Gonzalez Document · semafor.com · 8 Oct 2026 Companies in Japan, South Korea hit by major cyberattacks See the source
2. 2 NW NHK WORLD Third-party reporting · www3.nhk.or.jp · 7 Oct 2026 Unauthorized access, personal data leaks surge in Japan | NHK WORLD-JAPAN News See the source
3. 3 SF Startup Fortune Third-party reporting · startupfortune.com · 8 Oct 2026 AI hacking tool traced in South Korean bank breaches as CrowdStrike flags wider trend - Startup Fortune See the source
4. 4 E english.news.cn Third-party reporting · english.news.cn Japan hit by string of cyberattacks, data breaches affecting millions See the source
5. 5 TJ The Japan Times Third-party reporting · japantimes.co.jp · 7 Oct 2026 Cyberattacks against Japanese firms continue, putting millions at risk of identity theft See the source
6. 6 NW NHK WORLD Third-party reporting · www3.nhk.or.jp Japan sees spate of corporate website hacking cases | NHK WORLD-JAPAN News See the source