The execution rate of the banking sector's information protection budget has shown a declining trend over the past three years. Although the scale of budget allocation expanded, execution did not keep pace, resulting in more than 120 billion won of unexecuted budget last year alone. As hacking and customer data leakage incidents have occurred one after another in the financial sector, movements to expand security investment, which had previously been viewed as a target for cost reduction, are gaining momentum.
According to documents submitted by the Financial Supervisory Service to the office of People Power Party lawmaker Lee Yang-soo on the 12th, the information protection budget execution rate for eight banks—KB Kookmin Bank, Shinhan Bank, Hana Bank, Woori Bank, NH NongHyup Bank, Kakao Bank, K Bank, and Toss Bank—was recorded at 69.0% last year. This marked a second consecutive decline, following rates of 74.5% in 2023 and 70.8% in 2024. Of the 397.8 billion won budget allocated last year, the actual executed amount was 274.4 billion won, leaving 123.4 billion won unexecuted.
The banking sector's information protection budget increased by 21.2% over two years, from 328.2 billion won in 2023 to 397.8 billion won last year, but the executed amount rose only 12.2%, from 244.6 billion won to 274.4 billion won. Consequently, the unexecuted amount increased from approximately 83.5 billion won in 2023 to 123.4 billion won last year.
KB Kookmin Bank executed 39.3 billion won out of its 67.6 billion won budget last year, resulting in an execution rate of just 58.1%. NH NongHyup Bank executed 48.1 billion won (63.9%) out of 75.3 billion won, and Shinhan Bank executed 31.7 billion won (69.9%) out of 45.3 billion won.
Hana Bank was the only one among the five major banks to see a decrease in its information protection budget, dropping by 3.8% from 55.1 billion won in 2023 to 53 billion won last year. In contrast, Woori Bank increased its budget by 50.5%, from 52.3 billion won to 78.7 billion won. Information protection personnel also saw changes: KB Kookmin Bank's headcount decreased by 10.5% from 95 to 85, while Woori Bank's increased by 32.0% from 76.5 to 101, Shinhan Bank's rose by 11.2% from 85.25 to 94.78, and Hana Bank's grew by 9.7% from 72 to 79.
Even when compared with other financial sectors, the banking sector had the lowest execution rate. Last year's information protection budget execution rates were recorded at 90.5% for card companies, 82.0% for securities firms, 75.3% for life insurance companies, and 104.2% for non-life insurance companies. However, unexecuted budgets do not necessarily mean investment reduction; differences can arise depending on project schedules or contract amounts.
Recent successive hacking incidents are bringing changes to the perception of security investment within banks. In the past, expanding security personnel and budgets was not easy amid efforts to promote cost efficiency and organizational slimming. Some in the financial sector even say it is fortunate that this incident provides an opportunity to bolster security personnel and budgets. It is assessed that this situation can serve as a catalyst for expanded security investment, given that it is difficult to prove the effectiveness of investment unless an incident occurs immediately.
A source at a commercial bank stated, "While banks have certainly increased their security budgets as profits grew, there was an approach focused on cost efficiency because no serious security incidents occurred." The source added, "If no incidents occur, organizations inevitably shrink and cut costs. It was a situation where personnel were reduced and organizations downsized in all areas, not just security."
Banks are taking steps to review their security systems and expand investment. Shinhan Bank plans to re-examine its budget management direction and investment fields and allocate its information protection budget at the highest level in the industry. A source at Shinhan Bank revealed, "As emphasized by the Financial Services Commissioner, we recognize security not as a simple cost but as an investment, and are reviewing various projects that can substantively strengthen our information protection system."
Hana Bank formed a task force (TFT) for data breach response immediately after recognizing the incident and launched emergency system inspections through a dedicated team including external experts. The bank also plans to expand expenditures for building an AI-based intelligent cybersecurity system.
KB Kookmin Bank has also established and is operating a TFT for personal information leakage incidents, with plans to significantly expand its next year's information protection budget allocation to over 100 billion won. It is proceeding with new security projects worth approximately 5.1 billion won to respond to AI-utilized security threats, aiming to complete them within the year.
In the financial sector, it is pointed out that the effectiveness of the security system is important in addition to budget expansion. A source in the banking sector stated, "Ultimately, discovering and monitoring security issues is what matters." The source added, "There may have been a complacent mindset during system development or maintenance, thinking 'surely this part wouldn't be a problem.' We must reflect on whether internal personnel were also negligent."
The source continued, "It seems the paradigm regarding information security will change completely with this incident. Everything from budgets to personnel will change," emphasizing, "We must have the awareness that we should properly invest in security budgets and not skimp in these areas."
in FINANCE
