The boards of South Korea's major financial groups have been warning about the risks of artificial intelligence-driven cyberattacks since last year and calling for stronger defenses, according to board minutes reviewed by Seoul Economic Daily. Because those board-level discussions failed to prevent data breaches, analysts say the effectiveness of security management systems needs to be examined.
Song Sung-joo, an outside director at Shinhan Financial Group, reviewed the company's response to novel AI-based attacks at a special board meeting in March last year and said the firm "must not neglect investment and improvement efforts to defend against them," financial industry sources said on the 12th. Kwak Soo-keun, another Shinhan Financial outside director, said in August that year, in connection with the group's information security risk management: "Strengthening internal controls is important, but similar incidents will recur unless timely investment in human and material resources is made at the business level. Active investment and support of resources are needed."
Shinhan Financial Group's board received a report in January this year on the leak of personal data belonging to Shinhan Card merchants and discussed response measures. In February, it deliberated on measures to strengthen the group-wide information security management system, and in May it received an audit report on that system.
Warnings that a security breach could threaten a financial firm's survival also surfaced at the board of its subsidiary, Shinhan Bank. The bank recently suffered a hacking incident that exposed the personal information of 25,000 customers. Yamamoto Shinji, an outside director at Shinhan Bank, presented on "The Importance of Financial Security and Board Considerations" at a board workshop in October last year and noted that "a single security breach can be devastating enough to lead to a liquidity crisis."
At some banks, directors demanded reviews of specific hacking response practices. Kwon Young-sun, an outside director at Hana Bank, asked the risk management committee last year to report on hacking drill cases and the results of business continuity plan (BCP) simulations.
At a KB Financial Group board meeting in March last year, directors offered an opinion on an agenda item covering the establishment and implementation of personal data protection plans, calling on the group to "go beyond documented procedures and strengthen internal training and campaigns so that all employees recognize the importance of security and can actually carry out those procedures."
Concerns about the possibility of data leaks were also raised at the board of BNK Financial Group. Kim Byung-duk, an outside director, cited last year's personal data breaches at large corporations and said BNK Financial could not consider itself an exception. He stressed the importance of the role of the chief information security officer (CISO) in particular, urging reviews of subsidiaries and follow-up monitoring.
The board of Woori Financial Group, where no personal data breach has been confirmed to date, also showed strong interest in cybersecurity threats. Lee Eun-joo, an outside director, said that "applying AI technology appropriately in the field is important" and stressed the need to "stay faithful to the basics so that information security risks do not materialize." Kim Young-hoon, another outside director, said: "Given how frequently personal data breaches have been occurring recently, response measures need to be prepared on the conservative assumption that data may already have been exposed externally. What matters is not only preventing leaks but also having measures for how to prevent leaked information from being misused."
Financial regulators revised the Regulation on Supervision of Electronic Financial Transactions last year to strengthen boards' oversight responsibility for financial security, requiring CISOs to report major security matters to the board. Financial firms have accordingly brought information security items before their boards and subcommittees to discuss response measures.
Still, with data breaches occurring despite repeated board warnings, some say it is necessary to examine whether management translated those warnings about security risks into substantive preventive measures. Kim Dae-jong, a professor in the business administration department at Sejong University, said regulators "should comprehensively review the effectiveness of financial companies' breach response drills, the level of in-house expertise secured for core security functions and the management of vendors' system access rights." He added that authorities "should make clear the principle that ultimate responsibility for preventing and responding to security incidents lies with management."
Regulators are also pursuing institutional changes to strengthen the authority and independence of CISOs. A proposed amendment to the Electronic Financial Transactions Act pending in the National Assembly would impose fines of up to 3% of revenue when a breach occurs and require board approval for the appointment of a CISO. The aim is to raise the standing of security officers and expand board involvement. A ruling party official said debate on the bill "is expected to pick up in earnest after the parliamentary audit."