[Exclusive] Shinhan, KB, Hana Hit by Hacks Also Rate Security Self-Checks 'Inadequate'

Shinhan Rated 1 Item Inadequate; KB Kookmin and Hana Rated 2 Each
From Authentication and Authorization Checks to Session Integrity... Security Control Gaps Identified
KB Kookmin and Hana Rated All Items “Satisfactory” in Final Inspections... Key Is Whether Security Systems Work in Practice

Shinhan Bank, KB Kookmin Bank and Hana Bank, which recently suffered hacking attacks that exposed customer information, rated some items as “inadequate” in IT security self-inspections conducted at the direction of financial authorities, it has been confirmed. Among major commercial banks targeted by hackers, security gaps were laid bare at Shinhan, KB Kookmin and Hana, where personal information was leaked. With data breaches occurring one after another at major banks handling large volumes of financial transactions, calls are growing for the effectiveness of existing security systems to be strengthened.

Yonhap News Agency

According to a “Financial Sector IT Security Self-Inspection Checklist for Preparing for Cybersecurity Incidents” obtained by the office of Rep. Park Sung-hoon of the People Power Party on October 14, Shinhan Bank rated one of the 12 inspection items as inadequate. KB Kookmin Bank initially marked two items as inadequate, but said its final inspection later found all 12 items to be satisfactory. Hana Bank also rated two items as inadequate in its initial inspection, but after taking corrective measures, submitted a final inspection showing all items as satisfactory. By contrast, Woori Bank and NH NongHyup Bank, which were also targeted by hacking attacks but had no confirmed customer information leaks, marked all 12 items as satisfactory. However, since the inspections were conducted by the financial companies themselves, a satisfactory rating does not necessarily mean that they have no potential security vulnerabilities.

The inspections followed a directive from financial authorities, issued in response to recent widespread hacking attacks targeting the financial sector, for banks and credit card companies to urgently review their security vulnerabilities and response systems. Earlier, from September 27 through October 3, six banks - Shinhan, Hana, KB Kookmin, Busan, NH NongHyup and Woori - were targeted by external hacking attacks. Personal information was leaked for approximately 25,000 people at Shinhan Bank; 119 people at KB Kookmin Bank, including 99 customers and 20 employees; and 89 people at Hana Bank.

The item that Shinhan, KB Kookmin and Hana banks all rated as inadequate concerned controls for verifying the integrity of service requests, including API requests, and preventing horizontal privilege escalation. Even when users are logged in, access permissions must be checked at the service-request stage to ensure they cannot view other customers’ information. The banks received inadequate ratings on an item assessing whether these controls were working properly. Session integrity verification is the process of checking that a user’s connection remains valid and that service requests have not been altered or falsified. Preventing horizontal privilege escalation means stopping users from accessing other customers’ information without authorization when those customers have the same level of permissions. If these security systems do not work properly, there is a risk of inappropriate access to other customers’ information.

KB Kookmin Bank and Hana Bank also rated as inadequate items checking for missing authentication and authorization functions in external-facing systems, such as websites, and for access-control vulnerabilities. In the actual hacking incidents, the routes through which customer information was leaked were also work-related systems accessible from outside: Shinhan Bank’s inquiry service for loan recruiters, KB Kookmin Bank’s mobile work-support system for employees, and Hana Bank’s Office Data System (ODS) for sales support. However, it has not been confirmed whether the inadequacies identified in these self-inspections were the same vulnerabilities exploited in the actual attacks. The banks said they had completed corrective measures for the issues identified in the inspections.

Some observers say that it is difficult to assess financial companies’ actual security capabilities based solely on the results of self-inspections. What matters is whether security controls work properly when an actual hacking attack occurs. Park Chan-am, CEO of S2W and an advisory member of the Security Special Committee under the Presidential National AI Strategy Committee, said, “Companies must fully identify all systems exposed to external access and verify that authentication and authorization checks are performed along every route used to access customer information.” He added, “After finding vulnerabilities, they need to recheck the results of corrective actions and update the scope of inspections whenever new services or external connections are introduced.”

Rep. Park Sung-hoon said, “These security incidents are clear cases of human error caused by the complacent response systems in place until now.” He stressed, “Finance cannot exist without trust, so companies must immediately review their security status from the ground up and fix the problems.”

Meanwhile, according to the Financial Services Commission, 16 financial companies across all sectors, including banks, were found to have suffered cybersecurity incidents around the time of the hacking incidents in the financial sector. The total number of leaked records reached 100,000. Financial authorities have decided to conduct a comprehensive inspection of financial companies’ security frameworks and management systems to prepare for AI-powered hacking threats. They will also increase the frequency of vulnerability assessments to at least twice a year for large financial companies with many customers.

This content was produced with the assistance of AI translation services.