Sector-wide self-audit results on 12-item checklist to be shared

AI-based attack response, further breach prevention measures on agenda

The Financial Services Commission office at Government Complex Seoul in Jongno-gu, Seoul [Yonhap]
The Financial Services Commission office at Government Complex Seoul in Jongno-gu, Seoul [Yonhap]

A wave of cyberattacks on South Korea's financial sector has spread to Saemaul Geumgo and OK Savings Bank, prompting regulators to convene a meeting to review the industry's security posture. Authorities plan to examine the results of a sector-wide self-audit and discuss follow-up measures to counter attacks using AI-based tools.

The Financial Services Commission held a meeting Wednesday afternoon, chaired by Secretary General Shin Jin-chang, with officials from the Financial Supervisory Service, the Korea Financial Security Institute and related ministries in attendance. The session was called to share the results of a security review conducted across the entire financial sector following a string of recent breaches and to discuss further response measures.

"Based on a 12-item checklist, we will identify areas that fall short and take additional steps to address them," an FSC official said.

Earlier, financial regulators had ordered all financial institutions to conduct self-audits following a data leak at Shinhan Bank at the end of last month. Firms were required to submit results by Thursday covering 12 items — including whether attacker IP addresses had been blocked, whether intrusion attempts or damage had occurred, vulnerabilities in externally exposed IT assets, whether enhanced authentication procedures had been applied, and whether real-time security monitoring and detection systems were in operation.

The meeting also examined signs that AI-based tools were used in recent attacks. Regulators said they plan to discuss measures to detect and block AI-assisted hacking at an early stage.

The FSC has maintained its push to ease network-separation regulations, viewing expanded AI use in cybersecurity as necessary. However, the selection of institutions eligible for a second round of network-separation deregulation — a process delayed by the recent string of breaches — was not expected to be addressed at Wednesday's meeting.

Additional incidents came to light while the audit was still under way. Saemaul Geumgo, a nationwide network of community credit cooperatives, confirmed that a recent hack exposed the personal data of about 400 customers. Information leaked on a per-customer basis included customer numbers, names, encrypted resident registration numbers, account numbers, contact details, addresses, email addresses and account balances.

The Korea Federation of Saemaul Geumgo said it blocked the attacker's IP address and a proxy IP used to bypass security after detecting the breach, and has since conducted vulnerability checks and remediation on its website. It is notifying affected customers individually and has pledged full compensation for any losses incurred.

OK Savings Bank also reported to regulators that the personal data of 183 customers had been leaked through its online loan application process. Authorities and the company are investigating the specific attack vector and whether additional damage occurred.

The confirmed breach victims in the financial sector now include Shinhan Bank, KB Kookmin Bank, Hana Bank, Busan Bank, Yegaram Savings Bank, Welcome Savings Bank, Hyundai Capital Services, Saemaul Geumgo and OK Savings Bank. It has not yet been confirmed whether the newly identified incidents were carried out by the same threat actor behind the earlier attacks. Regulators are comparing attack methods and intrusion routes to determine whether the cases are linked.

Regulators are currently conducting on-site inspections of Shinhan Bank and KB Kookmin Bank, and have also launched field checks at Yegaram Savings Bank and Welcome Savings Bank. Based on the outcome of Wednesday's meeting, authorities plan to finalize additional security measures and strengthen response requirements for individual financial institutions.


rim@heraldcorp.com