Credential stuffing is an attack that automatically tries username and password pairs leaked elsewhere to log in to multiple services.
If you reuse a password across services, a password leaked at one may open other accounts.
In early October, customer information leaks were confirmed at several financial companies.
The security industry analyzed the Shinhan Bank incident as a basic attack combining credential stuffing, manipulated API requests, and insufficient authorization checks (Boan News, 10/2).
Financial authorities, however, have not established the official cause and are investigating (Electronic Times, 10/3).
Users should review unique passwords and additional authentication for each service, and check for exposure through their bank's official app or website.
Organizations must recheck authorization for every request, even after login.
What is credential stuffing, and how does it work?
A credential is account information used to log in; stuffing means filling it in.
The attack tries account information obtained in advance from other platforms, including through the dark web, at login screens at random (Boan News, 10/2).
The sequence is as follows. Obtain a leaked list: acquire username and password pairs leaked from other sites.
Automated attempts: a program tries logging in to many services at once.
Successful accounts: only accounts using the same password open.
Credential stuffing therefore centres on password reuse rather than sophisticated hacking techniques.
Using a different password for every service makes it difficult to reuse a leaked pair directly on another account.
What was confirmed about the early October bank breaches?
The following includes only information confirmed through financial company announcements and reporting.
Financial authorities and the companies have not yet established the specific causes and attack methods and are investigating (Electronic Times, 10/3).
| Financial company | Confirmed information | Source |
|---|---|---|
| Shinhan Bank | Announced on October 1 that information concerning about 25,000 loan-related customers had leaked, including 66 resident registration numbers and 97 CI identifiers. The bank promised full compensation for resulting losses | Boan News, 10/1 |
| KB Kookmin Bank | Confirmed information leaks affecting 119 customers | Electronic Times, 10/3 |
| Hana Bank | Confirmed information leaks affecting 89 customers | Electronic Times, 10/3 |
| BNK Busan Bank | Confirmed information leaks affecting 11 outsourced employees | Electronic Times, 10/3 |
| Woori Bank and NH NongHyup Bank | Detected external access attempts, but no leak was confirmed | Electronic Times, 10/3 |
| Non-bank financial institutions | Information leaks affecting 40,000 Yegaram Savings Bank customers and 146 Hyundai Capital mortgage loan solicitors | Boan News, 10/3 |
Analysis of the Shinhan Bank incident suggested that stolen account information was tried at random to pass identity authentication, and that login attempt limits and account lockouts appeared to be absent.
The analysis says repeated requests were then sent to a customer lookup API while changing customer numbers (Boan News, 10/2).
The Financial Supervisory Service began an emergency on-site investigation at Shinhan Bank (Boan News, 10/1), and the Financial Services Commission convened an emergency review meeting across the financial sector on October 4 (Boan News, 10/3).
What did AI change?
The Financial Security Institute identified indications that a Chinese-language open-source autonomous AI penetration tool had been used in an attack targeting a financial company on September 28.
The attacker attempted to breach several South Korean financial companies (Daily Secu, 10/2).
An October 4 report said financial authorities believed the same group was responsible (Seoul Shinmun, 10/4), but common attribution has not yet been confirmed in an official announcement (Boan News, 10/3).
KCBCA Signals explains that AI does not create vulnerabilities that were not there, but helps attackers find, understand, and exploit existing weaknesses much faster (p.20).
Attackers use automation and AI to scan numerous companies and software systems for the easiest entry point.
Weak links consequently become easier to expose (p.20).
Credential stuffing is not a new technique either.
What has changed is that basic gaps, such as login screens without attempt limits or APIs without authorization checks, can be discovered faster.
Even a valid login requires fresh checks on requests
Signals p.28 describes AI agents as follows.
Authentication was correct, system access was authorized, and the permitted API call succeeded.
The action could nevertheless be inappropriate for the circumstances.
This is a failure that is easy to miss because everything appears normal (p.28).
Analysis of the bank incident points to the same issue.
An authenticated account reportedly changed only the customer number in its requests, and the server failed to filter them out (Boan News, 10/2).
API security does not end with a single login.
For every request, the server must recheck whether this account is authorized to view this customer's information.
User checklist: what to do now
| Action | Reason |
|---|---|
| Check password reuse | Find services sharing a password and change each to a different one |
| Enable additional authentication | Add another barrier at login even if the password leaks |
| Review login history | Look for unfamiliar access |
| Use a separate email password | Email is used for password resets and identity verification |
| Check through official apps and websites | Do not open links from unclear sources |
Compiled from AhnLab's account information protection practices (Electronic Times, 10/2).
Check exposure and compensation procedures directly through the bank's official app, website, or customer service centre.
It is safer to avoid links in text messages using news of the incident as a pretext.
Organizational checklist: revisit the basics
| Item | Details |
|---|---|
| Rate-limit login attempts | Slow or block repeated attempts in a short period; use account lockouts or additional authentication for suspicious activity |
| Authorize each request | Verify data access permissions on the server for every API request, even after login |
| Detect unusual bulk lookups | Alert on repeated lookups with changing identifiers or sharp increases in API calls |
| Review externally exposed APIs | Inspect all authorization structures and review historical logs |
Compiled from general security practices and Financial Security Institute recommendations (Daily Secu, 10/2).
The Financial Security Institute noted that IP blocking alone is insufficient.
Attackers continually change proxy servers to connect (Daily Secu, 10/2).
Frequently asked questions
Q. How can I find out whether my information leaked?
Check through your financial company's official app, website, or customer service centre.
Do not enter personal information through text message links impersonating leak notifications.
Q. Is changing my password enough?
Change passwords not only for the breached service but also for other services where you used the same password.
Credential stuffing targets precisely that reuse.
Enabling additional authentication adds another barrier even if a password leaks.
Q. Has AI made this more dangerous?
AI does not create vulnerabilities that were not there, but helps find existing weaknesses faster (p.20).
This makes the basics more important.
Key points
- Credential stuffing tries leaked login pairs on other services
- Analysis suggested the bank breaches combined this technique with gaps in API authorization checks; the official cause remains under investigation
- AI changes the speed of finding weak links, rather than creating holes that did not exist (p.20)
- Authorization must be checked for every request, even after a valid login (p.28)
For more on security fundamentals in the AI era, see the KCBCA Signals report.
Read KCBCA Signals Vol.1 Issue 1
References: KCBCA Signals Vol.1 Issue 1. Rob Goehring (Wisr.ai CEO), p.20; Minseung Kang (Tnaps founder and CEO), p.28. Reporting: Boan News, 10/1, 10/2, 10/3; Daily Secu, 10/2; Electronic Times, 10/2, 10/3; Seoul Shinmun, 10/4
