[비즈한국] The fallout from hacking incidents in the financial sector is expanding into a debate over the accountability of bank CEOs. With the National Assembly’s National Policy Committee designating the CEOs of the five major commercial banks as witnesses for the national audit, the financial sector's security response systems and internal control issues are expected to come under intense scrutiny. In particular, as Shinhan Bank, which suffered the largest scale of personal data leakage, finds it difficult to avoid questioning, attention is focused on whether Shinhan Bank CEO Jung Sang-hyuk will be reappointed. Although CEO Jung led an increase in performance during his tenure, he now faces accountability for the hacking incident as his term nears its end. With Shinhan Financial Group having begun the process of selecting the next bank president, it remains to be seen whether this national audit will impact the selection.
The National Assembly’s National Policy Committee has designated the CEOs of the five major commercial banks (KB Kookmin, Shinhan, Hana, Woori, and NH NongHyup) as witnesses for the national audit. On the 8th, the National Policy Committee, chaired by Yoo Dong-soo, passed a motion to summon KB Kookmin Bank CEO Lee Hwan-ju, Shinhan Bank CEO Jung Sang-hyuk, Hana Bank CEO Lee Ho-sung, Woori Bank CEO Jung Jin-wan, and NH NongHyup Bank CEO Kang Tae-young as witnesses for the Financial Supervisory Service (FSS) audit to be held on the 19th. The reason for the witness request is to examine issues regarding hacking incidents in the financial sector.
Attention has shifted to the National Policy Committee’s audit as the five major bank CEOs were belatedly summoned. Initially, the audit was criticized as being "toothless" because no major financial company heads were set to testify, but the situation changed after the five bank CEOs were added as witnesses. In particular, all five CEOs are now burdened with accountability issues regarding their handling of hacking incidents while approaching the end of their terms.
The National Policy Committee summoned all banks that experienced hacking attacks regardless of whether damages occurred, but questioning is expected to focus on Shinhan Bank. This is because it suffered the largest scale of data loss among the three banks (Kookmin, Shinhan, Hana) that had personal information leaked via recent external hacking attacks. The number of leaked personal data records by hacking was 25,727 for Shinhan Bank, 153 for Kookmin Bank, and 89 for Hana Bank.
The aftermath of the hacking incident has led to claims regarding the CEOs' responsibilities. Politicians have argued that information security incidents are internal control issues, and therefore the CEO, as the final authority, must be held accountable. During the Financial Services Commission (FSC) national audit on the 8th, Rep. Kim Hyun-jung of the Democratic Party of Korea, a member of the National Policy Committee, argued that in the case of Shinhan Bank, which saw the largest scale of leakage, the legal responsibility of CEO Jung Sang-hyuk must be examined and unpaid performance bonuses should be clawed back.
Rep. Kim pointed out that Shinhan Bank paid performance bonuses despite receiving 11 disciplinary sanctions (fines and penalties) from financial authorities during CEO Jung's tenure (as of November 2023 to December 2025). Rep. Kim criticized this, stating, "Among the criteria for the 400 million won performance bonus received by CEO Jung for the 2025 fiscal year, ‘internal control for establishing sustainable trust’ was included," adding, "He received a bonus despite failing in internal control, with a significant number of accidents occurring even before this leakage."
Rep. Kim also pointed out that while internal regulations of Shinhan Financial and the bank stipulate that 'if losses occur related to assigned duties, deferred performance compensation will be recalculated to reflect the realized loss scale,' they have never actually cut or clawed back executive deferred compensation for 2024–2025 despite the occurrence of internal control failures.
Furthermore, she demanded the FSC to: verify with the FSS whether the Shinhan Bank compensation committee and board of directors followed established standards; take legal action after confirming violations of the CEO’s oversight duties; and cooperate in legislating a "clawback" system to recover performance bonuses when employees cause losses to the company.
Rep. Kim said, "The process for selecting the next bank president is underway even before holding the current CEO accountable," adding, "Taking responsibility means the CEO as the final authority receives the punishment stipulated by law, has their performance bonuses clawed back, and compensates for the damages caused to the company."
Shinhan Bank CEO Jung Sang-hyuk took office in February 2023 and successfully secured a reappointment in December 2024. His term expires on December 31, 2026. While the possibility of a third term had been discussed due to Shinhan Bank’s rising performance under his leadership, he has emerged as a variable in the future selection process as calls for accountability arose following the personal data leak.
During CEO Jung’s tenure, Shinhan Bank’s net profit (consolidated basis) increased from 3.0677 trillion won in 2023 to 3.6954 trillion won in 2024 and 3.7748 trillion won in 2025. In the first half of 2026, it recorded 2.4585 trillion won, an 8.5% increase compared to the same period last year (2.2558 trillion won).
However, following the hacking incident on September 28, criticism regarding Shinhan Bank's security response system has grown, amplifying the call for CEO Jung’s accountability. According to the office of Rep. Sohn Myung-soo of the Democratic Party of Korea, it took Shinhan Bank 15 hours to detect the attack after the initial hack, and about 30 hours to finally block it. According to Shinhan Bank, there have been no reports of secondary damages among customers whose personal information was leaked. Financial authorities are currently conducting an on-site investigation regarding the leak.
Meanwhile, Shinhan Financial Group began the succession process for its subsidiaries last September, sharing information on the succession candidate pool with the Shinhan Bank Executive Recommendation Committee (ERC) and granting it the authority to recommend candidates. Starting this year, the bank's ERC has expanded its influence in the selection process, participating from the stage of recommending candidates to the final verification.
According to the tentative schedule, once the bank's ERC delivers the candidate pool and eligibility requirements, the group's Subsidiary CEO Recommendation Committee will deliberate in October and November, and recommend the final candidate to the bank in early December. Afterward, the candidate will undergo verification by the bank's ERC, with the final resolution to be made at the board of directors meeting and shareholders' meeting in December.