A hacking campaign that began at South Korean banks has spread to cryptocurrency exchanges and capital firms, raising the number of financial companies with confirmed breaches to 16. Regulators estimate that about 100,000 pieces of personal data have been leaked.
The Financial Services Commission said on the 14th that a second emergency response meeting held at the Government Complex Seoul reviewed the progress of the investigation into the breaches and discussed measures to improve security management across the industry. The meeting, chaired by FSC Secretary General Shin Jin-chang, was attended by the Financial Supervisory Service, the Financial Security Institute and other related agencies.
Five companies were newly identified as having suffered breaches: DB Savings Bank, KDB Capital, Brightfix, Streami and Prabang. Streami operates Gopax, a won-based cryptocurrency exchange, and Prabang also runs a cryptocurrency exchange. Brightfix is an electronic financial services company that provides payment services. The companies identified by regulators span multiple sectors, from commercial banks to savings banks, specialized credit finance companies, mutual finance firms and online peer-to-peer lending platforms.
Some companies disclosed the scale of their individual losses. KDB Capital said on its website that it detected signs of unauthorized external access to its systems on the 12th of this month. The exposed data included the names, resident registration numbers and dates of birth of 848 customers. At Prabang, the contact details and addresses of 20 users were confirmed to have leaked. DB Savings Bank, by contrast, said its security systems blocked the external attack and that there were no indications of customer data leaks.
The data confirmed leaked so far amounts to roughly 100,000 items, including customer names, phone numbers, resident registration numbers and email addresses. Regulators have found no evidence that information that could be directly exploited for payments, such as card numbers and account passwords, was compromised. The number of affected companies and the scope of the damage could still change, however, as financial firms continue their own investigations using the attackers' internet protocol addresses already identified.
Security management at financial companies also proved weak. Regulators asked 555 companies to conduct self-assessments across 12 categories by the 8th of this month, and 130 of them reported areas requiring improvement — 23.4% of all companies surveyed. The remaining 425 companies submitted findings they deemed adequate. By sector, electronic financial services companies and online peer-to-peer lending platforms reported relatively more problems.
Regulators plan to fundamentally overhaul how financial companies manage security to prevent a recurrence of the problems revealed in the review. All financial firms will be required to identify every computer system connected to external networks, and authorities will examine whether access permissions, authentication procedures and internal management frameworks are appropriate. Regulators will also spell out the procedures by which chief executives, chief information security officers and chief information officers are briefed on security matters and held accountable for them.
Vulnerability checks will also become more frequent. Regulators plan to revise rules to require regular inspections at least twice a year, starting with large financial companies that serve many users or operate complex externally connected systems. Authorities are also considering having the Financial Security Institute work with sector associations and federations to build a joint security monitoring system to strengthen defenses at smaller financial firms.
"It is deeply painful that basic requirements were found not to have been properly observed at financial companies, even though we have repeatedly called for comprehensive inspections and stronger management on various occasions," Shin said. "We will push ahead more carefully and with greater speed on regulatory improvements, including easing network separation rules, to establish a security framework in which AI attacks are defended against with AI."