Korean banks plan bigger 2027 cyber budgets after breaches

By Rebecca Stone

Shinhan Bank plans to allocate 115 billion won to information security in 2027, nearly 2.8 times its 40.6 billion won allocation for this year.

The figures come from data submitted Monday by South Korea’s four major banks to Rep. Lee Yang-soo of the main opposition People Power Party.

The planned increases followed a series of suspected AI-assisted cyberattacks that raised concerns across the financial sector.

Customer impact is already measurable: the disclosures report breaches at Shinhan, KB Kookmin and Hana.

The funding decision matters because the same disclosures identify three unresolved operating concerns: budget execution, specialist staffing and the authority of chief information security officers.

What are the four banks planning for 2027?

According to the bank data submitted to Rep. Lee Yang-soo, three lenders have set 2027 totals while KB Kookmin Bank is still considering its plan.

• Shinhan Bank: 115 billion won for 2027 information security, compared with 40.6 billion won this year.
• Hana Bank: 100.1 billion won for 2027, up from a 31.8 billion won allocation this year.
• Woori Bank: 76.3 billion won for 2027, compared with 61.6 billion won this year.
• KB Kookmin Bank: More than 100 billion won under consideration for 2027, against 86.1 billion won this year. The figure has not been finalized.

The accompanying data put 100 billion won at $74 million. Shinhan and Hana have set totals above that threshold, KB Kookmin may exceed it, and Woori’s 76.3 billion won remains below it.

Every proposed or considered total exceeds the relevant bank’s disclosed allocation for this year. The figures raise the financial commitment, but the accompanying account warns that larger budgets do not necessarily translate into stronger cybersecurity defenses.

What did the recent breaches affect?

According to the submitted data, three lenders disclosed customer data exposure. The figures range from dozens of affected people at Hana to about 25,000 at Shinhan.

• Shinhan: An October data breach exposed the personal information of about 25,000 customers.
• KB Kookmin: A separate breach affected 2,210 customers, significantly more than the bank’s initial estimate of 119.
• Hana: The bank confirmed that personal information belonging to 89 customers had been leaked.

The disclosures connect the planned increases to a series of suspected AI-assisted cyberattacks, but they do not identify each named breach as AI-assisted. The attacks remain described as suspected, leaving their technical attribution unresolved in the submitted material.

The disclosures identify personal information but do not provide a common set of fields, breach methods or timelines. That limits comparisons of severity. The customer counts still establish the scale of exposure behind the budget decisions.

For the banks, the immediate burden is operational. Three institutions have disclosed customer information exposure, and their next budgets must fund defenses against a series the accompanying account describes as suspected AI-assisted attacks.

Will bigger budgets produce stronger defenses?

This year’s information-security budget execution rates at the four banks ranged from 60 percent to 87 percent, according to the submitted data.

• KB Kookmin: The bank expects to spend 52 billion won of its 86.1 billion won allocation, or 60.4 percent.
• Woori: The bank expects to spend 87 percent of its 61.6 billion won budget.
• Hana: The bank spent 23.9 billion won, or 75.3 percent of its 31.8 billion won allocation, in the first half.

The measurements do not cover identical periods. Hana’s 75.3 percent represents money spent in the first half, while KB Kookmin’s 60.4 percent and Woori’s 87 percent are stated as expected spending against this year’s allocations.

The range matters because the 2027 totals measure intent rather than completed security work. KB Kookmin sits near the 60 percent floor while considering more than 100 billion won, and Woori reports the highest execution rate. The submitted material gives no separate Shinhan execution rate.

That makes execution the first practical test for the larger budgets. The disclosures warn that larger allocations do not necessarily translate into stronger defenses, and KB Kookmin’s figures show why: budget approval and actual deployment remain separate steps.

How large are the specialist teams?

The submitted data also identify specialist staffing as a concern. Dedicated security specialists form a small share of the banks’ IT workforces, according to the disclosed workforce figures.

KB Kookmin had 1,673 IT employees this year. Only 17 worked as dedicated security specialists, accounting for about 1 percent of its IT workforce.

At Shinhan, security specialists made up 6 percent of IT employees, while Woori’s share was 5.6 percent. The submitted material does not publish Hana’s specialist ratio.

The contrast with budget growth is visible in the filings. Shinhan seeks 115 billion won with a 6 percent specialist share, while KB Kookmin is considering more than 100 billion won with about 1 percent devoted to dedicated security roles.

The plans do not specify how much of the 2027 money will fund specialist recruitment. Existing IT headcount does not become dedicated security capacity automatically, so staffing remains a separate execution question from funding.

How much authority do the CISOs have?

Authority within the banks is the third concern. According to the submitted data, all four chief information security officers hold additional positions, including chief privacy officer roles.

KB Kookmin’s CISO holds five positions. One is the equivalent security role at the bank’s New York branch, according to the disclosure.

Over the past three years, Woori was the only one of the four banks to report an instance in which its CISO put a decision on hold or exercised veto power over security concerns.

Woori’s record provides one disclosed example of security leadership intervening over security concerns. KB Kookmin’s five-position load shows that a CISO title does not necessarily amount to a single, dedicated remit.

The submitted material reports no comparable intervention at the other three banks. The unresolved governance question is whether CISOs can devote time to cybersecurity and exercise the authority to delay or veto security decisions.

What must change before 2027?

The next year’s spending decisions can be tested against the three issues the disclosures identify. Each has a measurable baseline.

• Budget execution: Current execution ranges from 60 percent to 87 percent, with KB Kookmin at 60.4 percent.
• Specialist staffing: KB Kookmin has 17 dedicated specialists among 1,673 IT employees, while Shinhan and Woori report shares of 6 percent and 5.6 percent.
• CISO authority: Every bank’s CISO holds additional roles, and only Woori reported a security-related hold or veto during the past three years.

The disclosed 2027 figures start at Woori’s 76.3 billion won. Shinhan and Hana exceed 100 billion won, and KB Kookmin is considering more. The immediate question is not whether budgets have grown. It is whether execution, specialist capacity and decision authority can strengthen in the face of suspected AI-assisted attacks.