Hacking attacks are continuing to hit South Korea's second-tier financial institutions, including savings banks and mutual credit cooperatives, even after financial authorities ordered emergency security checks across the entire industry. Analysts say attackers are broadly probing and targeting customer-information systems at firms with relatively weak security.
OK Savings Bank detected a hacking attempt on the 12th after repeated login errors occurred on its loan information lookup page, according to financial industry sources on the 14th. An investigation confirmed that an attacker had made multiple login attempts on the accounts of 183 customers, a pattern similar to earlier hacking attacks on commercial banks. Whether personal data was actually leaked has not been confirmed, and OK Savings Bank is investigating the scale of the damage and the circumstances of the breach with two outside security firms.
DB Savings Bank also suffered a data leak from a hacking attempt. MG Community Credit Cooperatives, where the information of 400 customers was leaked, believes it was attacked using methods similar to those used in previous hacks of financial firms.
Financial authorities had ordered firms to check for vulnerabilities in externally exposed information technology assets and services and to tighten access controls, following the recent string of hacking incidents in the financial sector. But with further attacks occurring, critics say the effectiveness of each firm's security response system needs to be verified.
An official at the Financial Security Institute said of the recent attacks that attackers are "not targeting specific financial firms but attacking across the board, looking for weak points in security," noting that the attacks have continued at relatively smaller institutions. "Financial authorities ordered firms to check vulnerabilities in externally exposed IT assets and tighten access controls, but we need to look at whether that was properly carried out on the ground," the official said.
Emergency inspections conducted by financial authorities through the 8th also found a relatively high number of deficiencies in sectors with comparatively weak security capabilities, such as electronic financial businesses and online investment-linked finance. Of 555 firms examined, 130 were found to have deficiencies.
Financial authorities have decided to prepare support measures to strengthen the security capabilities of small and mid-sized financial firms. The Financial Security Institute plans to review building a joint artificial intelligence-based security monitoring system together with industry associations and federations in each sector, and also plans to introduce a method of checking vulnerabilities in externally exposed systems from an attacker's perspective.