A string of hacking attacks on South Korea's financial sector exposed the personal data of more than 19,000 people at two online investment-linked finance companies, known as P2P lenders. The two firms were attacked before major commercial banks, raising questions about security protocols across the industry.
Data submitted by the Financial Supervisory Service to Rep. Shin Dong-wook of the People Power Party, a member of the National Assembly's National Policy Committee, showed on the 20th that 19,214 people had their personal information exposed in breaches at PFCT and Mouda. Mouda accounted for 18,900 of those victims and PFCT for 314. Financial regulators are still investigating the scale of the damage, so the final count may change.
Both firms were hit before the bank breaches that have already been disclosed. PFCT was attacked for about an hour, from 3:29 a.m. to 4:34 a.m. on Sept. 27, and Mouda was targeted around 11:54 a.m. the same day. Those times came about 19 hours and 50 minutes and 11 hours and 25 minutes, respectively, before the attack on KB Kookmin Bank at around 11:19 p.m. that day.
The attack on PFCT exploited a server-side template injection, or SSTI, vulnerability to reach administrator functions in the company's investment service. Members' personal information, including resident registration numbers, was exposed in the process. PFCT detected the breach the day it occurred and reported it to regulators the following day, Sept. 28.
In Mouda's case, the attacker routed traffic through multiple internet protocol addresses to exploit security vulnerabilities on the company's website, investigators found. Mouda confirmed signs of a breach on Sept. 28 and reported the incident to the Personal Information Protection Commission and the Korea Internet & Security Agency, or KISA, on the afternoon of Sept. 29.
Investigators also found similarities in how the companies were attacked. Some of the IP addresses used in the hacks of Shinhan Bank and Kookmin Bank overlap, according to officials, meaning the possibility that a single hacking group struck multiple financial firms in succession cannot be ruled out. Still, IP addresses used for proxy access can be shared among different attackers, so establishing a definitive link requires further investigation.
A total of 16 financial companies have confirmed damage from the series of breaches, according to regulators. The victims span banks, savings banks, capital firms, mutual finance cooperatives, P2P lenders and virtual asset service providers.
Yegaram Savings Bank has reported the largest number of affected individuals at 42,926. Shinhan Bank reported 25,729, followed by Mouda with 18,900. Welcome Savings Bank reported 2,117, OK Savings Bank 518 and Korean Federation of Community Credit Cooperatives about 400. The total across the financial sector is estimated at roughly 100,000 people.
Because the companies were attacked one after another during the Chuseok holiday, some analysts said the breaches exposed gaps in security coverage on days off. Calls are growing for smaller financial firms, which have a harder time securing information security staff and budgets than large banks, to strengthen management of system vulnerabilities and detection of abnormal access.