About 100,000 Records Exposed in Financial Firm Breaches... FSC to Inspect Security Systems Across the Sector

FSC Holds Second Emergency Response Meeting: "Number of Affected Financial Companies Could Rise"
Breaches at 16 Financial Companies; Approximately 100,000 Records Leaked
Comprehensive Review of Security Frameworks and Management Systems; Clarifying

In the period before and after the hacking incidents targeting the financial sector, breaches were confirmed at 16 financial institutions across all sectors, including banks. The scale of the data leak alone reached 100,000 records. To prepare for AI-powered hacking threats, financial authorities will conduct a comprehensive inspection of financial companies' security frameworks and management systems. They will also increase vulnerability assessment frequency to at least twice a year for large financial companies with many customers.

On October 14, the Financial Services Commission (FSC), chaired by FSC Secretary General Shin Jinchang, held the "Second Emergency Response Meeting" with the Financial Supervisory Service (FSS) and other relevant agencies to discuss these measures. The meeting was held to review the results of inspections using a checklist that the FSS distributed to financial companies following widespread hacking attacks targeting the entire financial sector, and to discuss policy measures to prevent such incidents from recurring.

According to the FSC, breaches were confirmed at a total of 16 financial companies across all sectors before and after the incident at Shinhan Bank. These included banks, savings banks, mutual finance institutions, specialized credit finance companies, electronic financial businesses, online investment-linked financial businesses, and virtual asset service providers. The FSC said the number of affected financial companies could increase, given that companies are still checking for breaches based on shared IP addresses and other information.

The scale of data leaks confirmed at financial companies so far is around 100,000 records. The leaked information included names, contact details, resident registration numbers, and email addresses. No leaks of account or card numbers, which could pose a risk of direct fraudulent payments, have been confirmed.

As of October 8, inspections using a 12-item checklist had been completed at 555 financial companies. A total of 425 companies reported that they met the requirements, while 130 reported deficiencies. Most of the companies with deficiencies were found to need improvements in one or two checklist items related to security patches and security monitoring systems. Relatively more deficiencies were found in the electronic financial business and online investment-linked financial business sectors, which have comparatively limited security capabilities. Each financial company has reported a plan for prompt corrective action and is already carrying it out.

The FSC will conduct a comprehensive inspection of financial companies' security frameworks and management systems to address vulnerabilities identified in this review. In particular, it plans to inventory and update all points where IT systems connect to external networks, and to clearly define and manage authentication and access-control permissions for those external connections. It will also provide guidance and oversight to ensure that companies clearly define how they operate and manage their security frameworks, including management of external connections, as well as reporting procedures and areas of responsibility for CEOs, CISOs, CIOs, and others.

The FSC will establish a system for detecting hacking threats to the financial sector early and responding to them jointly, while also creating a regulatory foundation to ensure that financial companies maintain close, ongoing security management. Under the Electronic Financial Transactions Act and the Regulation on Supervision of Electronic Financial Transactions, financial companies and electronic financial businesses are required to conduct vulnerability inspections and assessments once a year, while external websites must be assessed twice a year. Going forward, the FSC plans to increase the frequency of vulnerability inspections and assessments to at least twice a year, starting with large financial companies that have broad attack surfaces and many external connections and serve large numbers of customers. It will also pursue measures to include critical external connections among the required inspection targets and establish a basis for conducting inspections as needed.

The FSC will also pursue support measures for small and midsize financial companies that may lack sufficient capacity to respond to AI security threats. The Financial Security Institute plans to consider building an AI-based joint security monitoring system with sectoral associations and federations, and to pursue a range of measures, including attack-surface inspections to prepare for AI-related threats (black-box testing) and tailored security guidance for small and midsize financial companies.

In addition, the FSC will promptly consider and pursue measures to strengthen security for businesses not covered by electronic financial transaction regulations, such as moneylenders and insurance general agencies, including quickly sharing guidance on how to respond to AI security threats.

Secretary General Shin said, "Taking this incident as an opportunity, we will do our utmost to ensure a thorough review and fundamental regulatory improvements across the financial sector's security framework. This will include not only management of attack surfaces, such as external connections and authentication at financial companies, but also security monitoring systems across the entire sector and accountability for CEOs and boards of directors."

This content was produced with the assistance of AI translation services.