Bank cyberattacks across multiple countries: How serious is the risk?

2 hours ago

5 min read

Based on sources published through November 5, 2026.

Incidents in Taiwan, South Korea and France have renewed concerns about financial cybersecurity. In Vietnam, warnings about intruders remaining undetected for months highlight another challenge: identifying attacks before suspicious activity turns into financial losses.

Several incidents have been reported close together. That does not establish that they happened simultaneously or were part of a coordinated global campaign. Understanding the risk requires separating the date of an attack from its disclosure date, and distinguishing exposed data, targeted balances and confirmed losses.

Taiwan, South Korea and France report different types of incidents

In Taiwan, Bank SinoPac said 427 unauthorized transactions affected 419 customer accounts on November 3, involving approximately NT$41.76 million. According to CNA’s November 4 report, the bank attributed the transactions to hackers breaching security settings at suppliers of its new mobile banking system.

SinoPac said affected customers had been reimbursed and that it had found no evidence of personal information being leaked. This distinction matters: unauthorized transfers do not automatically establish that customer data was also stolen.

In South Korea, Aju Press reported on November 5, citing financial authorities, that 37 financial companies had reported 40 cybersecurity incidents between September 30 and November 3. Approximately 473,000 records were exposed.

The affected organizations included banks and other financial businesses. Authorities had not confirmed direct financial losses to individual customers at the time of the report. The figures should therefore not be described as 37 banks losing customer funds.

In France, Crédit Mutuel Arkéa disclosed an attack on November 4. AFP reported fraudulent transactions of approximately €100 million, or US$112 million.

In its follow-up statement, Arkéa said attackers reached the bank through a service provider’s platform and used the bank’s own account. It said customer assets were unaffected, although some transfers were delayed. The bank did not confirm the US$133 million figure reported elsewhere and was still assessing the financial consequences.

bank-cyberattacks-global-risks-response — *Bank Cyberattacks Across Multiple Countries in November*

Vietnam highlights the danger of delayed detection

At the Smart Banking conference on October 22, State Bank of Vietnam Deputy Governor Pham Tien Dung warned that some intrusions had remained undetected inside banking systems for months, according to VnExpress.

Vietnam’s government news portal reported that the banking system processes approximately 100 million payment transactions a day, worth around VND1.2 quadrillion. Officials emphasized the need to monitor both cybersecurity events and business transactions.

The cited reports did not identify a complete list of affected banks or establish an aggregate loss. They highlight detection and response weaknesses rather than documenting a single attack against the entire Vietnamese banking system.

US and Indonesian cases show why timelines and figures matter

Two other cases illustrate how older incidents can appear in a current news cycle.

On November 3, the US Department of Justice announced an indictment against 14 defendants in an alleged account takeover conspiracy involving SIM swapping and corrupt insiders at banks and telecommunications companies.

The alleged conduct ran from July 2023 through November 2024. More than US$373 million referred to the combined balances of victims’ accounts recorded in a spreadsheet, not confirmed stolen funds. The charges are allegations, and defendants are presumed innocent unless proven guilty.

In Indonesia, a police statement published in July described the Bank Jambi case involving 6,609 customers and approximately IDR144.82 billion. Investigators said the transfers occurred on February 22, 2026, with funds converted into cryptoassets and moved abroad within hours.

These figures should not be added together as a global loss total. They measure different things, across different periods.

What makes the risk serious?

AI-powered cyberattacks: Supply chain risks & RCE vulnerabilities

Editorial assessment: The cases highlight three areas of concern: third-party access, identity and authentication controls, and the ability to detect and stop unusual transactions.

For additional background, see IPSIP’s overview of financial-sector cybersecurity trends.

The consequences also vary. A data breach may enable follow-on fraud. Unauthorized transactions can cause direct financial losses. A service outage can disrupt payments even when customer assets remain protected.

The IMF’s April 2024 Global Financial Stability Report described how severe cyber incidents could affect financial stability through reduced confidence, disruption of essential services and technological or financial interconnections. That is background analysis, not an IMF finding about the incidents disclosed in November 2026.

AI is a preparedness challenge, not a confirmed explanation for every attack

In a June 3 speech, the European Central Bank warned that emerging AI models could broaden access to sophisticated attack capabilities. It emphasized management responsibility and oversight of third-party dependencies.

Separately, the G7 completed a cross-border coordination exercise on May 18, simulating a major cyber incident across member jurisdictions, according to a US Treasury announcement published on July 31.

These activities demonstrate preparation. They do not establish that AI was involved in every case discussed here or that the cases were connected.

What customers and organizations can do

Published guidance

Vietcombank’s security guidance tells customers not to disclose one-time passwords and to notify the bank if they receive unexpected authentication codes, balance notifications or app activation alerts. It also recommends verifying information and transfer requests through official channels.

A State Bank of Vietnam warning republished by the Vietnam Bank for Social Policies advises users to avoid unfamiliar links and download applications only from official app stores.

For institutions, the IMF recommends developing and testing response and recovery procedures. The ECB emphasizes third-party oversight and information sharing.

Proposed actions for customers

The following are editorial proposals, not new regulatory requirements.

Enable transaction alerts and use transfer limits suited to ordinary needs, where supported.
Report unfamiliar transactions immediately through the bank’s official channels. Ask about restricting affected services and starting an investigation. Preserve transaction references, messages and timestamps; recovery depends on the circumstances.
Consider a backup payment method or a second account with an appropriate balance if continuity during an outage matters. This can reduce dependence on one service, but does not eliminate fraud risk.
Avoid making major decisions about withdrawing deposits or moving into cryptoassets solely because of an unsourced list of incidents.

Proposed actions for banks and businesses

The following are editorial proposals to adapt to each organization’s risk profile and applicable rules.

Review supplier access, remove unused accounts and restrict privileges to operational needs.
Connect technical alerts with transaction monitoring and clear response responsibilities. Organizations with staffing gaps could assess managed detection and response services (Vietnamese) against their coverage and escalation needs.
Require separate authorization for business payments and verify changes to beneficiary details through a previously established contact.
Scope authorized web and mobile application penetration testing around authentication, authorization and critical transaction flows. Retest after remediation.
Rehearse cyber incident response for supplier compromise, service outages and customer loss reports. Define decision authority, communications and service continuity arrangements.
In public updates, distinguish targeted funds, completed transfers, frozen assets and final losses.

Cybersecurity incident response service: Minimizing business damage

The next developments to watch are investigation findings, losses after recovery and evidence that corrective measures work. A cluster of disclosures alone does not establish a coordinated global attack.

-------------

Refferral