Shinhan Financial reports Shinhan Bank data incident

Shinhan Bank is assessing the incident’s scope and potential effects while reviewing its information security framework.

Rhea-AI Filing Summary

Shinhan Financial Group disclosed that its major subsidiary, Shinhan Bank, identified that an external party had accessed certain services and obtained customer information. After learning of the incident, Shinhan Bank reviewed the relevant systems and implemented security measures it deemed necessary.

Shinhan Bank is investigating the cause, circumstances, scope and potential impact with relevant authorities and external cybersecurity experts. It said it cannot yet reasonably quantify any specific effect on its financial condition, results of operations or business activities and continues to assess the potential impact. The bank is reviewing its information security framework and intends to implement practical measures to prevent recurrence, enhance security policies and strengthen cybersecurity training for all employees.

Filing Explained

The bank’s customer-information incident remains under joint investigation; the company says it will take appropriate steps, including any necessary disclosure under applicable law, if matters material to investors are identified.

Key Terms

unauthorized access, information security framework, foreign private issuer, Form 20-F

4 terms

unauthorized access technical

"scope and potential impact of the unauthorized access"

Entry into computer systems, networks, facilities, or data by people who do not have permission to be there—whether by hacking, stolen credentials, bypassing locks, or improper insider activity. For investors, unauthorized access matters because it can lead to stolen customer or financial data, operational shutdowns, regulatory fines, and damage to reputation—like someone breaking into a locked file cabinet and taking sensitive documents, which can reduce a company’s value and increase costs.

information security framework technical

"comprehensively reviewing its information security framework"

foreign private issuer regulatory

"REPORT OF FOREIGN PRIVATE ISSUER"

A foreign private issuer is a company organized outside the United States that meets tests showing it is primarily foreign-controlled and therefore qualifies for a different set of U.S. reporting rules. For investors, that means the company files less frequent or differently formatted disclosures with U.S. regulators and may follow home-country accounting and governance practices, so buying its stock is like dining at a well-reviewed restaurant that follows its home kitchen’s rules instead of the local menu — you get access but should check what standards apply.

Form 20-F regulatory

"Form 20-F"

Form 20-F is the standardized annual disclosure that non-U.S. companies must file with the U.S. securities regulator when their shares are traded in the U.S.; it contains audited financial statements, a plain-language description of the business, management discussion, governance details and key risk factors. It matters to investors because it provides a consistent, comparable company “report card” and rulebook, helping buyers assess financial health, governance and risks before investing.

FAQ

AI-generated questions and answers. How Rhea-AI works. Not financial advice.

What happened in SHG’s cybersecurity incident?

Shinhan Bank, a major subsidiary of SHG, identified that an external party had accessed certain services and obtained customer information.

How is Shinhan Bank investigating the SHG incident?

Shinhan Bank is conducting a joint investigation with relevant authorities and external cybersecurity experts into the incident’s cause and circumstances, as well as the scope and potential impact of the unauthorized access.

AI-generated analysis. How Rhea-AI works. Not financial advice.

Form 6-K: How Foreign Companies Report to the SEC →

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

Available on EDGAR 10/01/2026 - 06:07 AM Accepted by SEC EDGAR 10/01/2026 - 06:02 AM Learn about SEC filing dates

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, DC 20549

—————————————

FORM 6-K

—————————————

REPORT OF FOREIGN PRIVATE ISSUER

PURSUANT TO RULE 13a-16 OR 15d-16

UNDER THE SECURITIES EXCHANGE ACT OF 1934

For the Month of October 2026

Commission File Number: 001-31798

—————————————

SHINHAN FINANCIAL GROUP CO., LTD.

(Translation of registrant's name into English)

—————————————

20, Sejong-daero 9-gil, Jung-gu, Seoul 04513, Korea
(Address of principal executive offices)

—————————————

Indicate by check mark whether the registrant files or will file annual reports under cover of Form 20-F or Form 40-F.

Form 20-F  Form 40-F 

Cybersecurity Incident at Shinhan Bank

Shinhan Bank, a major subsidiary of Shinhan Financial Group (the “Company”), recently identified that an external party had accessed certain services and had obtained customer information.

Upon becoming aware of the incident, Shinhan Bank promptly initiated a review of the relevant systems and implemented the security measures deemed necessary. Shinhan Bank is also conducting a joint investigation with the relevant authorities and external cybersecurity experts into the cause and circumstances of the incident, as well as the scope and potential impact of the unauthorized access.

At this time, Shinhan Bank is not in a position to reasonably quantify the specific impact of the incident, if any, on its financial condition, results of operations or business activities, and continues to assess its potential impact.

Shinhan Bank is comprehensively reviewing its information security framework and implementing necessary measures to prevent further unauthorized access and mitigate any potential harm resulting from the incident. In addition, Shinhan Bank intends to implement practical measures to prevent the recurrence of similar incidents, enhance its security policies, and strengthen cybersecurity training for all employees.

This report is intended to provide investors with information regarding the facts currently known to the Company. If matters that may be deemed material to investors' investment decisions are identified in connection with the incident, the Company will take appropriate actions, including any necessary disclosure, in accordance with applicable laws and regulations.

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized.

				Shinhan Financial Group Co., Ltd.
				(Registrant)
Date: October 1, 2026				By:		/s/ JANG Jeong Hoon
				Name: JANG Jeong Hoon
				Title: Chief Financial Officer