INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Shinhan BizOn APO Backup Server Hacked Exfiltrating Encrypted Data

| 2026-10-25 15:44 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
Shinhan Bank confirmed an external attack on its APO Backup Service server, resulting in the exfiltration of encrypted data and potential personal data leakage. The incident occurred around October 25, 2026, when Shinhan discovered a vulnerability in their backup solution provider's system, leading to the release of encrypted data from the affected servers. The company immediately shut down the servers and blocked overseas IP access, notifying customers of the potential for personal data leakage. Customers were warned to be cautious of contact attempts impersonating the company or attacker, requesting stolen information or money. As a preventive measure, Shinhan is informing customers of the potential risk without confirming specific details on leaked data. The Korea Internet & Security Agency (KISA) was notified, and plans are underway to cooperate with related institution investigations while implementing additional security measures.
Technical Mitigations AI-generated
• Patch Ahsay's backup solution to address the identified vulnerability. • Block overseas IP access on affected servers immediately after shutdown. • Implement additional security measures as announced by Shinhan Bank and cooperate with related institution investigations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎2026/10/25
Threat actors successfully exfiltrated encrypted data from Shinhan Bank's APO Backup Service server.
organisation Encrypted Data External Context
Exfiltration of Encrypted Data External Context.
organisation Shinhan Bank
Shinhan Bank has confirmed an external attack on its APO Backup Service server and the external release of encrypted some data, notifying customers of the potential for personal data leakage.
organisation APO Backup Service
Shinhan Bank has confirmed an external attack on its APO Backup Service server and the external release of encrypted some data, notifying customers of the potential for personal data leakage.
organisation IP
The incident response team immediately shut down the affected servers and blocked overseas IP access.
organisation The Korea Internet & Security Agency
The Korea Internet & Security Agency (KISA) was notified, and plans to cooperate with related institution investigations while implementing additional security measures were announced.
organisation KISA
The Korea Internet & Security Agency (KISA) was notified, and plans to cooperate with related institution investigations while implementing additional security measures were announced.
organisation Personal Information Support Team
The company stated that it will accept inquiries and reports related to the incident through its Personal Information Support Team.
Intelligence Sources
Dailysecu 2026-10-25