The Financial Services Commission (FSC) reviewed the breaches at a meeting Thursday chaired by FSC Chairman Lee Eog-weon, bringing together financial regulators, industry associations and government officials to discuss cybersecurity measures.
A total of 40 cybersecurity incidents were reported by 37 firms from Sept. 30, when the first breach was identified, through Tuesday. The affected companies included four banks, five securities and investment firms, five savings banks, three insurers and 10 electronic financial service providers. Online peer-to-peer (P2P) lending platforms, credit finance firms and cryptocurrency businesses were also among those affected.
The leaked information included customer names, national identification numbers, bank account numbers and employee records. The FSC said, however, that no account passwords or other information that could be used for unauthorized payments had been found to have been leaked.
The stolen funds were mainly held by smaller cryptocurrency exchanges, electronic payment providers and P2P lending platforms. They included digital assets held in internet-connected wallets, known as hot wallets, as well as prepaid customer balances and funds held by lending platforms. No direct financial losses to individual customers have been confirmed so far.
The latest figures show a sharp increase from Oct. 14, when 16 companies had reported breaches involving about 100,000 records. Reports continued even after financial firms completed an initial round of security checks, particularly among smaller nonbank financial firms.
The government will now inspect about 580 financial firms, including cryptocurrency businesses not covered by the Electronic Financial Transactions Act, which governs electronic financial services in South Korea.
The inspections will examine security vulnerabilities in financial firms' systems, along with internal controls and the cybersecurity responsibilities of senior executives.
Financial firms must complete security checks of registered systems by Nov. 30, with reviews of unregistered systems and internal controls due by the end of December. Firms will conduct their own assessments, but the Financial Supervisory Service (FSS) and Financial Security Institute (FSI) will conduct on-site inspections if they find serious security vulnerabilities or inadequate reviews.
Lee warned that financial firms must take cybersecurity seriously, with senior executives facing legal consequences for major failures.
“We will not tolerate companies ignoring security risks, neglecting basic safeguards or allowing poor security checks and responses to cause or worsen breaches,” Lee said. “Senior executives, including CEOs, will be held accountable under the law for serious failures in security management or response.”
Regulators will allow firms to address previously overlooked security vulnerabilities without immediate penalties, provided they take corrective action. But breaches caused by poor security management after the inspections will face stricter enforcement.
The government also plans to upgrade its Financial-IT Incident Response Surveillance Control Tower (FIRST), a cybersecurity monitoring system that helps financial firms share threat information and coordinate responses. The upgraded system will be tested in December before being rolled out across the financial sector in the first quarter of 2027.
Large financial institutions will be required to check for security vulnerabilities twice a year, instead of once, and assess all systems accessible from outside their networks. Smaller firms will receive AI-powered security services and tailored guidance.
To prevent further damage from the stolen data, regulators will monitor the sale of personal information on the dark web and strengthen the AI-based Anti-Phishing Sharing and Analysis Platform (ASAP), which allows financial firms to share information on suspected scams and identify fraudulent accounts.
An AI-based tool for detecting suspicious transactions will also be tested this month to help identify and freeze accounts linked to scams. Authorities will support proposed legislation that would require financial firms to compensate victims for certain phishing losses even when the firms are not at fault.
The government will also launch a task force to develop plans to ease South Korea's network separation rules, which require financial firms to keep their internal networks separate from the internet. The move is intended to expand the use of AI-based cybersecurity tools.
Existing exemptions allowing financial firms to use AI and Software as a Service (SaaS), which provides access to software over the internet, for security purposes would become permanent. Authorities also plan to relax network restrictions through a regulatory sandbox program.
The government also plans to draft a Digital Financial Safety Act by the first quarter of 2027 to extend cybersecurity requirements, such as security management and incident reporting, to cryptocurrency operators, corporate insurance agencies and third-party technology providers, including cloud and platform companies.
The proposed law aims to close security gaps exposed by the recent cyberattacks by extending oversight beyond banks and other financial institutions.
Copyright ⓒ Aju Press All rights reserved.