2026 Woori Bank — 17,551 customers; vendor retained NFT-service CI data
Data compromised
Connecting information (CI) and nicknames (no phone/RRN/address per bank)
Technical writeup
Woori Bank disclosed that personal information of 17,551 customers who had consented to NFT-platform-related services was leaked after an employee at an external software developer retained customer data without authorization and uploaded it to a developer platform. Korea Herald (5 July 2026) reported the leaked fields included connecting information (CI)—an encrypted online identity token—and customer nicknames; phone numbers, resident registration numbers, and home addresses were not compromised. Data had been provided to the vendor in September 2024 for NFT platform development. The bank said it learned of the incident around 30 June / early July 2026, blocked access with the developer, notified PIPC, and warned that leaked CI could be abused if combined with other breaches.
Root cause
Third-party developer retained and uploaded entrusted customer data after project end