Woori Bank Personal Data Leaked During Re-Outsourcing... Banks on High Alert Over 'Third-Party Risk' and Internal Controls

17,551 Cases of Customer Data Exposed Due to Oversight Gaps in Contractor Management
FSS: "Inadequate Internal Controls"... Need to Address Blind Spots in Oversight

With the recent incident where an external development firm, contracted by Woori Bank, leaked customer personal information, “third-party risk management” has emerged as a key internal control challenge in the financial sector. Since a gap in oversight during the subcontracting process led to the incident, there are growing calls for banks to re-examine their supervision and management systems for all outsourced firms.

According to the financial industry on July 7, Woori Bank announced via a notice on July 3 that approximately 17,551 cases of customer personal information had been leaked. The leak occurred during the process in which the primary contractor, entrusted by Woori Bank, further subcontracted the work.

The Financial Supervisory Service (FSS) is currently investigating the circumstances of the incident while preparing for follow-up inspections. For now, the focus is on the lack of internal controls rather than the data leak itself. The leaked information confirmed so far includes connection information (CI), which is encrypted data used for online personal identification, and customer nicknames. Since CI is classified as personal information under the Personal Information Protection Act, the Personal Information Protection Commission is investigating Woori Bank. However, as CI is not classified as credit information under the Credit Information Act, the FSS explained that the incident does not fall under its inspection mandate at this stage. It is also being considered that, since CI is highly encrypted, it is unlikely to cause consumer harm.

An FSS official stated, “We are currently being briefed on the facts and monitoring the results of the commission’s investigation,” adding, “There were shortcomings in the management and supervision of external contractors, and we see this as an issue that requires improvements from an internal control perspective.”

However, the FSS reportedly has no plans to launch a separate inspection solely due to this incident. Should the commission’s investigation uncover evidence of a credit information leak, the FSS will initiate an inspection, but no such circumstances have been confirmed so far.

Woori Bank explained that the leaked information had been provided to an external development firm during the process of building a non-fungible token (NFT) platform in September 2024. The data should have been destroyed after the project ended, but it was found that an employee of the firm kept the data without authorization and subsequently shared it on an IT developer platform, resulting in the external exposure.

This incident is seen as an example demonstrating the vulnerability of third-party risk management in the financial sector. As financial institutions increasingly outsource IT development and operations during digital transformation—and as subcontracting becomes more common—the scope of management continues to expand. However, as this incident shows, gaps in oversight during outsourcing and subcontracting can lead to information security breaches. Calls are growing to strengthen third-party risk management as part of internal controls.

The general consensus in the industry is that follow-up inspections by the FSS are likely to result in administrative measures that require improvements in the management of contractors. If no additional credit information leak is found, the measures are expected to be limited to management advisories.

An industry official stated, “The core of this issue lies in how to manage third-party risks that can arise from the structure of outsourcing and subcontracting banking work. As digital transformation accelerates, it is necessary to further advance the supervision and management systems for external contractors and reinforce internal controls.”

This content was produced with the assistance of AI translation services.