Shinhan Bank suffered a data leak affecting about 25,000 customers through unauthorized access that bypassed authentication on a simplified inquiry service used by loan brokers. The exposed information included names, phone numbers, annual incomes and loan limits. The incident occurred despite the bank receiving an S grade, or 100 points, for six consecutive years in the Financial Services Commission's review of personal credit information management and protection practices, as well as holding ISMS and ISMS-P certifications for information security and personal data protection management systems. The Financial Security Institute is responding by tightening verification this year, including checks on access rights, access logs, abnormal activity monitoring and vulnerability assessments, and plans to add penetration testing next year.