The Financial Services Commission (FSC) disclosed the findings Wednesday after a second emergency response meeting with the Financial Supervisory Service (FSS), Financial Security Institute and other authorities.
The incidents were found across banks, savings banks, credit-finance companies, mutual-finance institutions, electronic-finance businesses, online investment-linked lenders and virtual-asset operators.
The affected firms include Shinhan Bank, KB Kookmin Bank, BNK Busan Bank and Hana Bank, along with four savings banks and companies in other financial sectors.
Authorities said the number of affected companies could rise as financial firms continue checking their systems against internet protocol addresses linked to the attacks.
About 100,000 records containing information including names, contact details, resident registration numbers and email addresses have been confirmed leaked so far.
No account numbers or card numbers that could be directly used for unauthorized payments have been found among the leaked data, the FSC said.
Authorities are investigating the attack routes and methods, whether the incidents are connected to the same attacker and whether artificial intelligence was used.
A separate emergency review of 555 financial companies found security shortcomings at 130, or 23.4 percent, while 425 reported no deficiencies under a 12-item checklist.
Most companies that reported shortcomings needed improvements in one or two areas related to security patches or monitoring, with weaknesses relatively more common among electronic-finance companies and online investment-linked lenders.
The problems included failure to apply the latest security patches, weak management of systems no longer supported by manufacturers and the absence of round-the-clock security monitoring.
Authorities also identified shortcomings in authentication and access controls for externally exposed systems, including cases where multi-factor authentication had not been introduced for critical services.
The FSC said financial companies with deficiencies were instructed to apply security patches, replace outdated equipment, strengthen monitoring and tighten authentication and access controls.
The government will follow the emergency checks with a broader review of financial companies' security systems, including external access points, authentication, internal controls and the responsibilities of chief executives and senior technology and security officers.
It also plans to expand vulnerability assessments for large financial companies to at least twice a year from the current annual cycle and establish grounds for additional inspections when urgent security risks emerge.
Authorities will also broaden the financial sector's threat-sharing system so information detected independently by individual firms can be distributed across the industry.
The government plans to develop AI-based systems to assess emerging cyber threats and detect vulnerabilities in externally exposed assets, source code and mobile applications, while considering shared AI-based security monitoring for smaller financial companies with limited resources.
"It is very painful to see that some financial firms failed to follow even basic security practices despite repeated calls to strengthen their defenses," said Shin Jin-chang, secretary general of the FSC.
He said authorities would review the industry's overall security framework, including monitoring systems and accountability at the CEO and board levels.
Shin also said the government would accelerate regulatory changes aimed at allowing financial companies to deploy more advanced AI-based cybersecurity tools.
"We will move quickly to establish a security system in which AI attacks are defended with AI," Shin said.
AJP Takeaways
- Cyber breaches have been confirmed at 16 financial companies, with about 100,000 personal-data records leaked, although no account or card-number leaks have been identified.
- An emergency review found security shortcomings at 130 of 555 financial companies, including outdated patches, weak access controls and gaps in round-the-clock monitoring.
- Authorities plan broader security reviews and AI-based threat sharing, while whether AI was used in the recent attacks remains under investigation.
Copyright ⓒ Aju Press All rights reserved.
