Woori Bank's headquarters in Jung-gu, Seoul. [Herald DB]
Woori Bank's headquarters in Jung-gu, Seoul. [Herald DB]

Personal data on more than 17,000 Woori Bank customers was leaked due to negligence by an employee at an outside software development firm, the bank said Thursday.

Woori Bank announced on its website Thursday that "an incident occurred in which 17,551 records of personal information that an outside development firm had retained without authorization were leaked due to negligence by an employee of that firm."

The leaked data consists of connected information (CI) — encrypted identifiers used to verify individuals online — and customer nicknames. The bank confirmed that member IDs, login credentials, passwords and financial transaction details were not compromised.

Woori Bank shared the data with the outside developer in September 2024 as part of a project to build a non-fungible token (NFT) platform. An investigation found that after the project concluded, an employee at the firm retained the information without authorization and later shared it on a developer platform, causing it to leak externally.

The bank said it "immediately blocked access to the relevant information through the development firm upon learning of the leak on Monday, reported the incident to the Personal Information Protection Commission, and posted a public notice on its website." It added that "as of now, there are no known cases of the leaked information spreading or being misused online or offline."

Regarding the leaked data, the bank said customer nicknames are "simply aliases that users enter at their own discretion," and "connected information is a value used to identify individuals online and, unless combined with other data, cannot be used alone to identify a specific person."

However, Woori Bank urged customers to exercise caution and avoid clicking on URL links in calls or text messages from unidentified sources, as a precaution against potential secondary harm. The bank said it has also applied a separate fraud detection system (FDS) to guard against unforeseen incidents and will conduct a comprehensive review of personal data management practices at all outside development firms, taking corrective action where deficiencies are found.

Woori Bank said it will verify and compensate customers as quickly as possible should any harm arise from the leak.


betterj@heraldcorp.com