South Korean cryptocurrency exchange Gopax has been confirmed as one of the victims of a recent string of hacking incidents in the financial sector, but it has not formally notified users of the breach, drawing growing criticism. The silence contrasts with other affected financial firms, including the coin-market exchange Prabhang, banks and savings banks, which disclosed the damage and issued apologies.
Gopax had still not posted a notice or an apology on its website as of the 15th, a day after the Financial Services Commission publicly announced the breach, according to financial industry sources. The FSC said on the 14th, at its second emergency response meeting, that breaches had been confirmed at a total of 16 financial companies, including Gopax.
Critics say Gopax's response has been more passive than that of other affected firms. Prabhang said on its website on the 9th that the personal information of about 20 customers had been leaked on the 2nd, and issued a formal apology. It also gave a detailed account of steps to prevent a recurrence, including blocking internet protocol addresses used in abnormal external access attempts and stepping up monitoring of suspicious logins.
Gopax, by contrast, has not disclosed how the breach occurred, whether personal information was leaked, or what measures it has taken to protect users. That leaves customers unable to determine whether they have suffered any actual damage or whether they need to take additional security steps.
Beyond the lack of transparency, concerns have also been raised about the exchange's data protection framework. Gopax is the only one of South Korea's five largest won-denominated exchanges that has not obtained Information Security Management System and Personal Information Management System (ISMS-P) certification. An official in the cryptocurrency industry said, "It is a problem that users cannot confirm the exact extent of the damage."