As hacking incidents have spread to the financial investment industry, concerns over the protection of investment information are growing among retail investors. While companies are working to strengthen security, it remains unclear when or where a security breach might occur. Against this backdrop, as regulations were recently relaxed to allow securities firms to utilize external AI (artificial intelligence), how well customer information can be safeguarded has become just as critical as the convenience of new services.
According to the financial investment industry on the 29th, hacking incidents at Daishin Securities, Mirae Asset Global Investment Management, and the virtual asset exchange Upbit were confirmed in succession the previous day. Daishin Securities suffered a leak of personal and credit information for 38,490 customers, while general business-related information was leaked from Mirae Asset Global Investment Management. Signs of employee information leakage were also confirmed at Upbit.
On this day, it was revealed that approximately 100 million won in asset losses occurred due to a hacking incident at the virtual asset exchange Praban. Praban temporarily suspended services after detecting abnormal withdrawals from an internet-connected virtual asset wallet on the 24th. The company plans to fully compensate for the damaged assets using its own funds. As successive intrusion incidents have been confirmed with actual monetary losses, investor anxiety is growing.
In this situation, there are calls to carefully examine the risks of information leakage and the effectiveness of security management in external AI-linked services recently permitted by financial regulators. The Financial Services Commission newly designated 24 innovative financial services on the 7th, 21 of which (87.5%) utilize external generative AI. Among the 14th companies that received these designations were six securities firms, including Kiwoom Securities, Korea Investment & Securities, Toss Securities, Hanwha Investment & Securities, Hyundai Motor Securities, and Kakao Pay Securities.
Until now, financial institutions have strictly restricted connections between internal business systems and the external internet to prevent hacking and other threats. This special exemption creates an exception to this restriction, allowing external AI services to be used in business operations. It does not mean that internal systems are fully opened to the outside or that customer information can be freely transferred.
By utilizing external AI, securities firms can improve services by responding more quickly to customer inquiries or explaining financial information more easily. However, the services designated this time include uses for employee work purposes, and none have been officially launched yet.
What is important for retail investors is what kind of information the AI utilizes. There is a difference between an AI explaining general stock market information and analyzing a customer’s actual investment records. In the latter case, it must be thoroughly managed whether personal information is transmitted to external AI and, if so, how it is protected. While connecting to external AI does not necessarily mean information leakage, security management is needed to prepare for risks that may arise in new information processing processes.
Attacks that induce AI to follow malicious instructions hidden in external materials should also be watched closely. For example, when a securities firm’s AI analyzes corporate disclosures or internet materials, it may mistakenly accept malicious instructions embedded in the materials as normal commands. This is known as "prompt injection." If the AI has the authority to look up customer information and transmit it externally, it could lead to data leakage. This is why it is important to prevent the AI from arbitrarily executing instructions contained in external materials and to limit access rights to customer information to the necessary scope.
Financial regulators are also preparing safety measures considering these risks. The Financial Services Commission stated that when allowing regulatory exemptions for the use of generative AI, it attaches conditions requiring compliance with strict control measures that replace existing security regulations.
A direct connection between recent hacking incidents and external AI-linked services has not been confirmed. However, the need to check how thoroughly securities firms are controlling the external transmission of customer information and system access rights as they increase their use of external AI has grown.
An official in the financial investment industry said, "Guiding retail investors so they can easily verify how their information is being used by AI is also a task," adding, "It is becoming very important for securities firms to enhance investment convenience with AI while securing trust in customer information protection."
in STOCK
