In response to a series of customer data breaches, banks have activated emergency response systems and are collaborating on security measures. They are intensifying efforts to block external access, conduct thorough vulnerability assessments, and monitor for unusual transactions to prevent further breaches and secondary damage. Attempts to access the IP addresses used in recent hacking incidents have also been confirmed at three internet banks, prompting initiatives to bolster security equipment and upgrade systems.
According to the financial sector on October 6, Chief Information Security Officers (CISOs) from various banks held a meeting at the Korea Federation of Banks to discuss countermeasures against recent hacking attacks. Topics included the current status of security checks at each bank, management of external access points, and rapid sharing of threat information for coordinated responses.
Following the financial authorities' sharing of the IP addresses used in the attacks and directives for internal assessments, access attempts from the same IPs were confirmed at Kakao Bank, K Bank, and Toss Bank. Reports indicate that Kakao Bank experienced multiple access attempts since January, while Toss Bank faced around ten attempts from January to August. All three internet banks successfully blocked these attempts, and no personal data breaches have been reported so far.
As traces of the attacks were found across several financial institutions, banks are verifying the extent of any damage and checking for similar vulnerabilities and additional infiltration routes. Financial authorities have instructed banks and card companies to confirm compliance with emergency inspections and assess the potential for further damage by October 6.
KB Kookmin Bank has conducted a comprehensive inspection of its external connection servers and strengthened security controls. The bank is also performing system-wide checks to identify similar vulnerabilities and potential infiltration routes, along with penetration testing from the attackers' perspective. They have enhanced monitoring through their Financial Transaction Monitoring System (FDS) and shared the results of incident analyses with their group cybersecurity center across all subsidiaries.
During the holiday period, Bank President Lee Hwan-joo and key executives held face-to-face meetings to regularly check the response status via a hotline. They are addressing the risks of potential system breaches and unusual transactions that could exploit leaked information.
Shinhan Bank has also activated its emergency response system following confirmation of data leaks, conducting real-time situation monitoring and comprehensive service inspections. During the holiday, President Shin Jung-hyuk and other key executives held daily strategy meetings. They are identifying and blocking malicious IPs while collaborating with external agencies and specialists to investigate additional attack routes.
Shinhan Bank has added detection scenarios for unusual activities to its FDS and plans to enhance monitoring of external channels, including the dark web and Telegram, to address the potential for further intrusions and the misuse of leaked information.
Hana Bank has blocked external access to its Operational Support System (ODS), which was targeted in the recent attacks, and is working to strengthen its authentication systems. The bank is conducting thorough checks of vulnerabilities in services that allow external access and has increased the alert levels for integrated security monitoring and FDS. They are also using AI-based security tools to assess services exposed to external threats.
Upon confirming signs of data leaks, Hana Bank promptly reported to its CEO and activated an emergency response task force. The management has been holding regular meetings to monitor the progress of follow-up actions.
Even banks that have not confirmed any data leak incidents are taking action. Woori Bank held an emergency meeting led by its CISO over the weekend and completed checks for potential data leak damages, finishing internal reports during the holiday. NH Nonghyup Bank also conducted urgent inspections of its systems and security controls and activated its emergency response system. They are blocking access and monitoring for unusual signs based on threat information shared by authorities and related organizations, reporting key inspection findings to management.
In addition to emergency responses, efforts to strengthen security infrastructure are underway. KB Kookmin Bank has recently announced bids for core security equipment purchases, including intrusion prevention systems (firewalls), DDoS mitigation systems, web application firewalls (WAF), and intrusion detection systems (IDS) to enhance its intelligent threat response capabilities.
NH Nonghyup Bank has completed the bidding and product selection for web shell response systems and DDoS mitigation systems in the first half of the year and is currently developing these systems. This is part of measures to enhance detection and blocking capabilities against web-based intrusions and large-scale denial-of-service attacks. Woori Bank also plans to expedite the enhancement of its security systems within the year.
A financial sector official stated, “As AI-driven attacks continue to evolve, it is challenging to block all risks with existing security systems alone. It is crucial to strengthen authentication systems for external business systems and reduce security blind spots by detecting abnormal access or mass information inquiries in real time.”
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.