As incidents of personal information leaks continue in the financial sector, the National Assembly's audit has intensified, leading to a surge in requests from lawmakers for security self-assessment results and incident response materials from financial companies. While the financial sector and authorities agree on the need to identify the causes and responsibilities of these incidents, there are concerns that sensitive information, such as attack paths and vulnerable systems, may be excessively exposed to the public. Critics also point out that deploying personnel for repetitive data responses could hinder actual incident recovery and prevent further damage.
According to the financial sector on October 7, 40 banks and card companies have completed self-assessments as requested by financial authorities and submitted the results through the Financial Supervisory Service's common intranet. Financial companies conducted checks based on 12 criteria, including potential external intrusion paths, system access controls, and unusual access occurrences.
Lawmakers are also demanding self-assessment results from individual financial companies, as well as updates on recent hacking attacks and defenses. The series of breaches has emerged as a critical issue in the financial sector, leading to a rapid increase in related data requests.
During this process, some materials, such as Toss Bank's attack prevention case and Busan Bank's self-assessment results, have been disclosed individually.
Within the financial authorities, there are concerns that security-related details could be circulated externally beyond necessity. If specific attack paths, vulnerable systems, and authentication and access control methods are revealed, it could provide attackers with clues to identify additional weak points.
A financial sector official stated, "Even if an attack is thwarted or there was no attack, disclosing this information could inadvertently make it a new target for attacks."
There are also concerns that repetitive data preparation could dilute the on-site response capabilities. The varying scope and format of requests from different lawmakers often require separate documentation for similar content.
Kwak Jin, a professor at Ajou University’s Cybersecurity Department, emphasized, "Currently, it is crucial for financial companies and investigative agencies to identify the causes of incidents and confirm any further damage while developing countermeasures. The use of identical or similar materials could dilute on-site response capabilities."
He added, "It is necessary to proactively conduct assessments, considering the possibility that attacks may shift to other industries or public infrastructure as well."
Meanwhile, preparations for a lawsuit by victims of the personal information leak have begun. The law firm Sedam has recently started recruiting plaintiffs for a lawsuit targeting victims of the Shinhan Bank data breach.
Sedam's representative, Shin Al-chan, noted, "Considering that approximately 25,000 customers were affected by the Shinhan Bank data leak, we expect around 200 to 300 individuals to participate in the lawsuit."
So far, the number of individuals expressing intent to join the lawsuit has been reported to be low. A legal industry source remarked, "We need to assess the scope of the information actually leaked by the financial company, and if there is a perceived chance of winning, we may recruit participants from other areas as well."
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.