As incidents of personal information leaks continue in the financial sector, the National Assembly's audit has intensified, leading to a surge in requests from lawmakers for security self-assessment results and incident response materials from financial companies. While the financial sector and authorities agree on the need to identify the causes and responsibilities of these incidents, there are concerns that sensitive information, such as attack vectors and vulnerable systems, may be excessively exposed to the public.
On October 7, it was reported that 40 banks and card companies have completed self-assessments requested by financial authorities and submitted their findings through the Financial Supervisory Service's common intranet. The financial institutions conducted checks based on 12 criteria, including potential external intrusion routes, system access controls, and unusual access attempts.
Lawmakers are also demanding self-assessment results from individual financial companies, as well as updates on recent hacking attacks and defenses. The series of breaches has emerged as a critical issue in the financial sector, prompting a rapid increase in related data requests.
During this process, some data, such as Toss Bank's incident prevention case and Busan Bank's self-assessment results, have been disclosed individually.
Within financial authorities, there are concerns that security-related details may circulate externally beyond necessity. If specific attack routes, vulnerable systems, and authentication and access control methods are revealed, it could provide attackers with clues to identify additional weak points.
A financial sector official stated, "Even if an attack is thwarted or there was no attack, disclosing this information could make it a new target for attacks."
There are also concerns that the repetitive nature of data preparation could dilute the on-site response capabilities. Each lawmaker's office has different requirements for the scope and format of requested data, leading to instances where similar information must be prepared separately.
Professor Kwak Jin of Ajou University’s Cybersecurity Department noted, "Currently, it is crucial for financial companies and investigative agencies to identify the causes of incidents and confirm any additional damage while developing countermeasures. The distribution of on-site response capabilities could occur due to the preparation of identical or similar materials."
He emphasized the need for proactive assessments, considering the possibility that attacks could shift to other industries or public infrastructure.
Meanwhile, preparations for a lawsuit by victims of personal information leaks have begun. The law firm Sedam has recently started recruiting plaintiffs for a lawsuit targeting victims of the Shinhan Bank data breach.
Shin Alchan, the representative attorney of Sedam, stated, "Considering that there are about 25,000 customers affected by the Shinhan Bank data breach, we expect around 200 to 300 individuals to participate in the lawsuit."
So far, the number of individuals expressing their intention to join the lawsuit has been reported as low. A legal industry source mentioned, "We need to assess the scope of the information actually leaked by the financial company, and if there is a possibility of winning, we may recruit participants for lawsuits elsewhere as well."
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.