South Korean savings banks are preparing to include plans to expand information security staff and budgets in their business plans for next year, following a string of hacking and personal data breaches across the financial industry. Welcome Savings Bank and Yegaram Savings Bank, both of which were hit by hacking, are also moving faster on follow-up steps, including a review of how much compensation to pay.
Shinhan Savings Bank plans to reflect an expansion of its information security workforce in next year's business plan, according to financial industry sources on the 13th. The lender is also considering doubling its current information security management staff. It is working out the exact size of the increase and the related budget, with details to be decided this month.
Woori Financial Savings Bank is also reviewing an expansion of information security staff and budgets as it draws up its business plan for next year. Woori Financial Group has recently discussed the need to strengthen information security capabilities at the group level, and the unit is firming up related plans. The scale of the staff increase and the budget will be decided in line with the group's business plan.
Computer systems in the savings bank sector are largely divided between proprietary networks and the shared network operated by the Korea Federation of Savings Banks. Savings banks affiliated with financial holding companies share the computer systems of their sister banks, leaving them closely tied to group-level information security policies. With hacking incidents hitting major banks in recent months, group-wide efforts to tighten security are spreading to their savings bank units.
Savings banks that suffered direct hacking damage are also speeding up preparations for compensation. Welcome Savings Bank is reviewing compensation for 2,117 people whose personal data was leaked. Yegaram Savings Bank is also drawing up a compensation plan for damage from its data breach.
Welcome Savings Bank said it will first examine precedents for compensation in similar past incidents. Payouts of 100,000 to 300,000 won ($70 to $210) per person are currently under discussion in the financial industry, and those figures are also said to be under consideration. A simple application of that range would put total compensation above 200 million won.
The bank is considering tapping reserves set aside for liability for damages under the Personal Information Protection Act. The law requires companies to buy insurance, join a mutual aid program or set aside reserves to cover such liability.
"The savings bank sector is not large in scale but serves a great many customers, so reinforcement of information security staff and budgets is needed," an official in the financial industry said. "The recent run of incidents should be the trigger for putting a stronger security framework in place."