KB Financial Delays SEC Disclosure for a Month as Data Breach Victims Jump to 2,210

KB Financial Group has not disclosed a customer data breach at its subsidiary KB Kookmin Bank to the U.S. Securities and Exchange Commission (SEC) for a month. As the scale of damage has grown significantly from the initial announcement, questions are being raised about the appropriateness of its disclosure response.

According to Gatenews on Nov. 3, KB Financial has delayed SEC disclosure of the Kookmin Bank data breach for a month, while Shinhan Financial showed a contrasting response by promptly disclosing a similar incident.

The number of victims in the KB Kookmin Bank data breach has surged from the initially reported 119 to 2,210. This follows the confirmation of additional damage to 1,631 customers and 460 employees during a regular inspection by the Financial Supervisory Service (FSS) on Oct. 26. The number of leaked data items also expanded from 17 to 39, including sensitive financial data such as account numbers, deposit balances, loan transaction details, and credit ratings.

KB Financial, which is listed on the New York Stock Exchange in the form of American depositary receipts (ADRs), must promptly provide major information such as significant cybersecurity incidents to U.S. investors through Form 6-K submitted to the SEC. The SEC requires disclosure decisions to be based on the impact of the information on a reasonable investor's judgment, rather than a uniform threshold for the number of victims. Legal experts note that even before calculating final financial losses, the need for disclosure should be assessed considering qualitative factors such as reputational damage and litigation risk.

In contrast, Shinhan Financial Group, which suffered a data breach affecting about 25,000 customers during the same period, showed a different approach. Shinhan Financial submitted Form 6-K to the SEC on Oct. 1, aligning with its domestic disclosure schedule. Although it was difficult to calculate the financial impact at the early stage of the investigation, it proactively informed investors of the incident overview and the status of investigations with authorities and external experts.

The FSS is reportedly examining not only the occurrence of additional victims but also the adequacy of KB Kookmin Bank's initial investigation and reporting procedures. The investigation covers whether the scope of initial data analysis was narrowed to intentionally reduce the scale of damage, as well as the overall internal control system. Regarding this, KB Financial said, "At this point, it is difficult to predict the financial impact of the incident," adding, "We are closely monitoring the situation and continuously reviewing disclosure requirements."

※ This article is an AI translation of the Korean original published by Korea Credit News; it was checked by automated quality guards and published by the English edition desk.