As Mirae Asset Securities, the No. 1 player in the financial investment industry, suffered a breach incident resulting in the leakage of account numbers for approximately 3,800 customers, attention is focused on the level of sanctions from financial authorities. This comes after amendments to the Financial Company Governance Act established a legal basis for holding CEOs accountable for security breach incidents. The key factors are expected to be how severe the consequences of the incident were and whether the CEO fulfilled their duty of care sufficiently to prevent it.
According to financial authorities and the financial investment industry on the 8th, regulators have begun on-site inspections of securities firms where breach incidents occurred, including Daishin Securities and Mirae Asset Global Investments. Mirae Asset Securities, which announced on the 6th that account numbers for approximately 3,800 customers had been leaked, is also expected to undergo an on-site inspection by the Financial Supervisory Service starting on the 9th. When a breach incident occurs, the IT Inspection Bureau of the Financial Supervisory Service and the respective company's assigned inspection bureau conduct joint on-site inspections; if there are indications of regulatory violations, the process transitions to a formal examination for further investigation.
In the case of this hacking breach incident, it is observed that CEO liability may be pursued, unlike typical MTS (Mobile Trading System) system failure incidents. Large securities firms with assets of 5 trillion won (assets under management of 20 trillion won) or more have been implementing a chart of accountability containing the CEO's overall management duty for internal controls since July last year.
In particular, breach incidents at securities firms such as Daishin Securities, Hanyang Securities, and Mirae Asset Securities occurred with intervals of at least several weeks after the Shinhan Bank breach incident was confirmed on September 30. During this period, financial authorities and the Financial Security Institute repeatedly urged securities firms to check for security vulnerabilities and update patches, leading to analysis that the responsibility of securities firms where incidents surfaced later is not light.
If financial authorities apply the Financial Company Governance Act in handling this breach incident, the level of CEO liability will likely hinge on "severity of outcome" and "adequacy of duty of care" regarding whether sanctions are imposed.
When introducing the chart of accountability, financial authorities presented a total of eight detailed judgment criteria, reflecting opinions from financial companies that "sanction standards were unclear." When judging the degree and results of illegal acts, they comprehensively consider factors such as △ failure to fulfill management duties, △ raising issues regarding the possibility of illegal acts occurring, △ occurrence of large-scale customer damage, and △ impairment of trust and order in the financial market, to determine whether the case is severe, ordinary, or minor.
How much due care a CEO exercised to prevent a breach incident is also an important consideration in the sanction process. Financial authorities stated that they would judge CEO liability based on criteria including △ whether executives could have predicted the outcome of the illegal act (incident) (predictability) and △ whether measures were taken to prevent it (outcome avoidance). Since breach incidents at securities firms occurred after incidents at banks and savings banks, there is a possibility that strict standards will be applied in terms of predictability.
Lotte Card, which experienced a breach incident involving the leakage of information for 2.97 million people on the 29th last year, prior to the introduction of the chart of accountability, had its CEO disciplined. At the time, financial authorities imposed a four-and-a-half-month business suspension and a 5 billion won surcharge on Lotte Card, and issued a "reprimand warning" to the CEO. The legal basis for sanctions at the time was the Credit Information Act, and there are distinctions from this breach incident, such as the number of data leakage cases being 2.97 million.
Meanwhile, financial authorities have announced plans to strengthen IT security-related governance and introduce punitive surcharges. Financial authorities plan to prepare and implement a security internal control guideline in the first quarter of next year. Additionally, they are pushing for amendments to the Electronic Financial Transactions Act (EFTA) that would impose punitive surcharges of up to 3% of total revenue in the event of a breach incident and strengthen CEO liability.
in STOCK
