As hacking and personal data leakage incidents continue to occur even in the financial sector and major retail industry, the gap in information security for SMEs (small and medium-sized enterprises) remains a blind spot. Concerns are emerging that due to a lack of security personnel and budget, it takes considerable time even to detect breaches, and incidents originating from outsourced external vendors lead to damages with no means of recourse.
According to the National Intelligence Service's "2026 National Information Security White Paper" released on the 7th, the rate of dedicated information security organization ownership among companies with 10 to 49 employees was only 1.6%, based on a survey conducted by the Ministry of Science and ICT and the Korea Information Protection Industry Association. This is a significant gap compared to companies with 250 or more employees (37.1%). The utilization rate of information security budgets also showed a large difference, at 50.2% and 88.3%, respectively.
The biggest obstacle cited by SMEs (small and medium-sized enterprises) is cost. In the same survey, challenges in information security were ranked as securing budget (49.1%), operation and management of security systems (45.7%), and so on. 23.0% of respondents also said that hiring specialized personnel was difficult. It is common for SMEs (small and medium-sized enterprises) to have IT or general affairs staff concurrently handle security duties, or to outsource management entirely to external vendors.
Consequently, small and mid-sized companies take considerable time even to detect and respond to breach incidents. According to an analysis of breach incidents from 2021 to 2025 by SK Shielders, it took an average of 106.1 days from initial intrusion to incident awareness and the commissioning and commencement of investigation. There were cases where it took up to 700 days, and more than half of initial intrusions occurred during personnel gaps between 6 p.m. and 5 a.m. the following day.
This contrasts with recent banking sector incidents, where it took several dozen hours from the start of an attack to detecting abnormal signs or recognizing leakage. According to materials disclosed by People Power Party lawmaker Kim Jae-seop at the National Assembly audit in October last year, Shinhan Bank detected unauthorized access within 15 hours and 26 minutes. Kookmin Bank and Hana Bank confirmed or recognized signs of leakage after 67 hours and 41 minutes, and 41 hours and 44 minutes, respectively.
For example, Barun Company, the operator of Barunsom M Card, confirmed illegal access to and tampering with its database in November last year only about a year later, on the 7th of last month. Online education company Mareunsoft also had information stolen in September last year but recognized the breach after receiving an abnormal transmission notice from its text message sending agent.
The fact that many SMEs (small and medium-sized enterprises) outsource the management of their websites or employee information systems to external vendors is also a risk factor. A representative case is the breach incident that occurred last month at The Bizon, an Enterprise Resource Planning (ERP) solution company with approximately 150,000 members including domestic SMEs (small and medium-sized enterprises) and tax and accounting offices. In fact, Jaewon Food, the operator of Ant & Sons, announced on the 30th of last month the possibility of personal information leakage for employees and store owners due to a breach in The Bizon's backup service.
In response to successive hacking and information leakage incidents, SME (small and medium-sized enterprise) related associations and organizations have stepped up efforts to raise security awareness and provide response support. The Korea Federation of SMEs (small and medium-sized enterprises) held an information security seminar with the Korea Information Protection Industry Association in May last year, and the Inno-Biz Association also signed an agreement with SK Shielders and DB Insurance last month to promote free security consulting and preferential 24-hour threat detection and response services.
An official from the Korea Federation of SMEs (small and medium-sized enterprises) said, "As AI and digital transformation accelerate, the importance of information security for SMEs (small and medium-sized enterprises) is also growing," adding, "Since many companies outsource security duties externally due to a lack of specialized personnel, a system must be established where security vendors can transparently share abnormal signs and communicate."
in LIVING
