Hacking incidents hit 16 financial firms, exposing 100,000 records in widespread breaches

The number of financial institutions that suffered a hacking incident, presumed to be an attack by an AI (artificial intelligence) agent, has been identified as 16, far exceeding the initially reported seven. The leaked information, including resident registration numbers, also reached approximately 100,000 records.

A security checklist review of a total of 555 companies in the financial sector found deficiencies at 130 firms. The financial authorities have decided to conduct comprehensive inspections of security systems and management systems, while expanding vulnerability checks and evaluations from once a year to twice a year or more, among other fundamental improvement measures.

The Financial Services Commission held its second emergency response meeting on the 14th, chaired by Secretary-General Shin Jin-chang, with relevant institutional investors including the Financial Supervisory Service, the Financial Security Institute, the Ministry of Science and ICT, the Ministry of the Interior and Safety, the Personal Information Protection Commission, and the National Police Agency.

Following an investigation into security breaches across the entire financial sector after the hacking incident at Shinhan Bank at the end of last month, the financial authorities identified that information leakage due to hacking occurred at a total of 16 financial companies. The incidents erupted across the board, involving banks, savings banks, mutual finance institutions, credit card and specialized lending businesses, electronic finance businesses, online investment-linked businesses, and virtual asset operators.

Specifically: △ In the banking sector, four institutions were affected: Shinhan, KB Kookmin, Busan, and Hana Bank. △ In the savings bank sector, four firms were involved: Yega람, Welcome, DB, and OK. △ In the specialized credit industry, two firms were affected: Hyundai Capital and Industrial Bank of Korea Capital. Additionally, △ in the online investment-linked business sector, two firms—PFCT and Mouda—and in the electronic finance sector (one firm) and virtual asset sector (two firms), incidents occurred at Brightpick, Streamy, and Praban, respectively. In the mutual finance sector, one incident occurred at the Saemaul Geumgo Central Association.

The Financial Services Commission stated that since financial companies are currently verifying whether breaches have occurred based on shared IP addresses and other data, the number of affected financial institutions may increase further.

The scale of information leakage in the financial sector confirmed so far is approximately 100,000 records, including names, contact information, resident registration numbers, and email addresses. According to the Financial Services Commission, while the scale of damage has increased compared to initial reports, no leakage of information posing a direct risk of unauthorized transactions, such as account numbers or card numbers, has been confirmed.

The Financial Services Commission announced that for financial companies where incidents have been reported, it has taken measures to prevent further breaches, including blocking attack IPs, applying security patches, and suspending related services. Additionally, the Financial Supervisory Service and the Financial Security Institute are thoroughly investigating the relevance of each case, whether the same entity is responsible, and the possibility of AI hacking by quickly identifying breach paths and attack methods based on field investigations.

The results of a 12-item checklist review conducted on all 555 financial sector companies up to the 8th showed that a total of 425 firms submitted reports rated as 'appropriate,' while 130 firms reported deficiencies. Most of the companies with identified deficiencies required improvements in one or two inspection items related to security patches and monitoring systems. A relatively large number of deficiencies were found in the electronic finance and online investment-linked business sectors, which have weaker security capabilities.

Specifically, reports mainly included: △ failure to apply the latest security patches; △ inadequate management of systems with End-of-Support (EOS) from manufacturers; △ lack of a real-time (24-hour) monitoring system; and △ inadequate attack surface management (such as missing authentication and authorization for external systems and failure to implement enhanced authentication procedures (MFA) for critical services). It was explained that the relevant companies are immediately implementing measures to address these deficiencies.

The Financial Services Commission will pursue fundamental institutional reforms to structurally and systematically prevent the occurrence of vulnerabilities discovered during checklist reviews and other processes. First, it will promote comprehensive inspections of financial companies' security systems and management systems. It will list and update all points where computer systems connect with external entities, clearly define and strictly manage authentication and access control permissions for these external connection points. The commission also plans to clarify the reporting structure and scope of responsibility for the operation and management of security systems, including external connection point management, as well as for CEOs (Chief Executive Officers), CISOs (Chief Information Security Officers), and CIOs (Chief Investment Officers).

A joint response system will also be established to detect hacking early. Hacking threat information identified by the Financial Supervisory Service and the Financial Security Institute is rapidly disseminated across the financial sector through integrated monitoring systems such as FIRST. The system will be improved so that threat information independently identified by financial companies is also shared via the integrated monitoring system. Efforts will also be made to build AI-based vulnerability inspection infrastructure capable of detecting vulnerabilities in externally exposed assets, internal source code, and mobile apps from an attacker's perspective.

In particular, vulnerability checks and evaluations, which are currently required once a year under relevant laws (twice a year for external homepages), will be expanded to twice a year or more, starting with large financial companies, to ensure that financial institutions conduct security management on a constant basis. Important external connection points must be included as mandatory inspection targets. For sectors that struggle to respond to AI security threats, such as small and medium-sized firms, loan businesses, and insurance agencies (GA), plans are in place to establish a joint security-related system.

Shin Jin-chang (Director) stated, "It is extremely painful that cases have been found where basic standards were not upheld by financial companies, despite repeated orders for comprehensive inspections and strengthened management through various opportunities such as the Lotte Card information leakage and the US Toss shock." He added, "Taking this incident as an opportunity, we will do our utmost to ensure a thorough re-inspection of the entire security system—including attack surface management such as external connection points and authentication management at financial companies, the security monitoring system across the financial sector, and securing accountability for CEOs and boards of directors—and fundamental institutional reforms."

Additionally, he emphasized, "To prepare for expanding AI security threats, we will more meticulously and swiftly pursue institutional improvements, including relaxing network separation regulations, to establish a security system that 'defends against AI attacks with AI.'"