[2026 Parliamentary Audit] Financial Sector Unaware of Incidents; Lotte Insurance Detected One After 902 Days, Toss Bank After 670 Days

A growing number of cases have emerged in which financial institutions realized only belatedly that electronic financial incidents and security breaches had occurred. Lotte Insurance took 902 days to detect a software error, while Toss Bank took 670 days.

Kim Hyungyeon, a lawmaker from the Rebuilding Korea Party. Office of Rep. Kim

According to data submitted to Rep. Kim Hyungyeon of the Rebuilding Korea Party, a member of the National Assembly’s Political Affairs Committee, by the Financial Supervisory Service (FSS), 91 incidents at 43 companies took more than a month to detect after they occurred, among the 2,189 electronic financial incidents and security breaches reported to the FSS from 2022 through August 2026. In 17 of those cases, the incidents went undetected for more than a year.

Among financial companies, 32 firms took at least 30 days to detect 75 incidents. Among electronic financial businesses that provide services such as mobile payments and payment processing, 11 companies took more than a month to detect 16 incidents.

Lotte Insurance took the longest to detect an incident. It took 902 days to identify a software error that occurred on November 1, 2023, detecting it only on April 21, 2026. Toss Bank detected a software error that occurred on May 7, 2022, 670 days later, on March 7, 2024.

AIA Life also discovered a software error 621 days after it occurred in November 2024. Hana Bank detected a software error 507 days after it occurred in April 2025 and paid 7.14 million won in compensation to 112 customers as a result. Shinhan Bank took 471 days to detect a software error that occurred in December 2023. Shinhan Bank had four cases in which detection took more than 180 days, the most among the five major banks.

Long-undetected incidents were also found among electronic financial businesses. Tmoney detected a software error that occurred in January 2024 only 428 days later, in March 2025. It paid 7.27 million won in compensation to 6,071 customers as a result.

External security breaches were also detected late. Eximbay detected a data leak that occurred in October 2022 309 days later, in August 2023. iM Bank detected a security breach caused by a vulnerability 178 days after it occurred. A malware-related security breach at Lotte Card, which suffered a large-scale personal information leak in 2025, took 19 days to detect from the date it occurred.

Toss Bank had the most cases among financial companies in which an incident was detected only after more than a month, with nine. Sh Suhyup Bank and KB Kookmin Bank followed with seven each, while Woori Bank, Shinhan Bank, and KakaoBank had five each. Among electronic financial businesses, Viva Republica and Tmoney had three cases each, while Google Payment Korea had two.

Most of the incidents detected late were software errors. Software errors accounted for 81 of the 91 cases that took at least 30 days to detect, or 89%. Calls are growing for stronger operational checks and monitoring systems to verify that software is functioning properly, in addition to security systems designed to block external attacks.

Rep. Kim said, "Consumers trust banks with their money and personal information, and they also follow the banks' requirements to install security software and complete complicated authentication procedures. If a bank itself can remain unaware of an incident for months after it occurs, who, exactly, are consumers supposed to trust?"

He added, "Since the emergence of Mythos, financial authorities have also rushed to introduce measures, but what matters is whether security systems on the ground have actually changed. Delayed detection can mean losing the opportunity to prevent damage from spreading. During this year's parliamentary audit, I will examine whether the financial sector's prevention and response systems, and the financial authorities' oversight and supervision, are functioning properly."

This content was produced with the assistance of AI translation services.