Basic controls lacking: security patches, round-the-clock monitoring, multi-factor authentication

Large firms to face vulnerability checks at least twice a year; AI-based joint monitoring also planned

The Financial Services Commission office at Government Complex Seoul in Jongno-gu, Seoul [Yonhap]
The Financial Services Commission office at Government Complex Seoul in Jongno-gu, Seoul [Yonhap]

Hacking attacks on 16 financial institutions — including banks and savings banks — have exposed roughly 100,000 customer records, financial regulators said Wednesday. An emergency inspection of 555 financial firms found that 130 had security deficiencies requiring remediation.

The Financial Services Commission convened its second emergency response meeting Wednesday, chaired by Secretary General Shin Jin-chang, with officials from the Financial Supervisory Service, the Korea Financial Security Institute and the Ministry of Science and ICT in attendance. The meeting reviewed the progress of ongoing breach investigations and discussed measures to strengthen cybersecurity across the financial sector.

Regulators have so far confirmed breaches at 16 financial firms. Among banks, incidents were identified at Shinhan, Kookmin, Busan and Hana Bank. In the savings bank sector, Yegaram, Welcome, DB and OK savings banks were affected. Hyundai Capital Services and KDB Capital were implicated in the credit finance segment, while PFCT and Mouda were named in the online peer-to-peer lending space. Breaches also occurred at electronic financial services firm Brightfix, virtual asset operators Streami and Prabank, and the National Federation of Saemaul Geumgo.

The confirmed data exposure amounts to approximately 100,000 records, including names, contact details, resident registration numbers and email addresses. No leakage of information that could directly enable fraudulent transactions — such as account or card numbers — has been confirmed so far.

The financial sector's own self-assessment also revealed shortcomings. Of 555 firms that completed checks across 12 categories by Thursday, 425 reported adequate controls, while 130 flagged areas needing improvement. Key deficiencies included failure to apply the latest security patches, inadequate management of systems past their end-of-support date, lack of round-the-clock monitoring and absence of multi-factor authentication.

Regulators plan to conduct comprehensive inspections of all external-facing IT system access points and tighten authentication and access controls. Starting with large financial firms that have extensive external exposure and large customer bases, vulnerability assessments will be expanded to at least twice a year, with a legal basis also to be established for ad hoc checks when needed.

This image is not directly related to the article. [Getty Images Bank]
This image is not directly related to the article. [Getty Images Bank]

Authorities also plan to bolster AI-based defenses. The integrated monitoring framework will be upgraded to allow threat intelligence gathered by individual firms to be shared across the entire financial sector, and work will begin on building an AI-driven threat-level information system and vulnerability assessment infrastructure. A shared AI security monitoring system for small and midsize financial firms is also under consideration.

"To prepare for the expanding AI security threat, we will push ahead more carefully and swiftly with institutional reforms — including deregulation of network separation rules — to establish a security framework in which AI attacks are countered with AI," FSC Secretary General Shin said.

Meanwhile, the Korean National Police Agency's integrated task force on telecommunications and financial fraud plans to send sequential alert text messages to about 48 million subscribers of the three major mobile carriers starting in the third week of this month, aiming to prevent secondary damage such as voice phishing and smishing that exploit the financial sector breaches. The messages will warn the public to be wary of requests for personal information or money transfers made under the pretense of loan condition adjustments or compensation for data leaks by parties impersonating financial institutions.


rim@heraldcorp.com