Suspicious access blocked
Financial industry sources said KB Capital discovered an unusual attempt to query information on Tuesday and confirmed a data leak. After detecting several suspicious attempts to access the system from domestic internet protocol (IP) addresses, it blocked those connections and alerted the regulator that day.
The tally of 1,811 affected people may be revised downward. A company official said some people could have been counted more than once.
Investigators have not identified who was using the domestic IP addresses or determined whether those addresses have any connection to IP addresses involved in previous attacks on financial institutions.
Personal and workplace information exposed
The customer records exposed in the breach contained names, birth dates, mobile phone numbers, addresses and vehicle registration numbers. The information affecting employees and partner staff included names and contact details, along with account IDs, departments, company names and job titles.
A KB Capital official clarified that the account data consisted of employee ID numbers and system login IDs, not passwords or authentication credentials. "This was not a hack carried out through the theft of employee accounts," the official said.
KB Capital has published a breach notice on its website and introduced a service through which people can check whether they were affected and which information was exposed, according to Seoul Economic Daily. The company has also pledged full compensation for any actual damage caused by the leak.
Lease operations system separate from financial systems
Employees and partner company staff use the affected internal platform to administer vehicle lease assets, including vehicle transport operations. KB Capital says the platform is not connected to financial transactions.
The breach concerns a central part of the company's business: Global Economic describes KB Capital as a specialized credit finance company affiliated with a large financial holding group, with vehicle leasing and rental as its core business.
KB Capital says the breached platform is physically separate from the core systems containing customers' credit and financial transaction data. On that basis, it sees no direct theft of financial assets.
Financial security industry observers cited by Global Economic nevertheless warn of potential secondary crimes. They say attackers could combine customers' vehicle numbers and contact details with employees' and partners' department, job title and account information to impersonate KB Capital or its partners in targeted spear-phishing and smishing attacks.
Earlier breaches and regulatory follow-up
YTN described the incident as the third hacking-related data leak in South Korea's capital finance sector, after breaches at Hyundai Capital and KDB Capital, also known as Saneun Capital.
According to Seoul Economic Daily, Hyundai Capital said a September attack exposed information about 146 mortgage loan agents, including their names, contact details and resident registration numbers. KDB Capital reported a breach last month involving 848 customers whose names, resident registration numbers and birth dates were exposed.
The Financial Supervisory Service is expected to inspect KB Capital on site, with staffing availability and other factors to be taken into account.
