The large-scale hacking attacks on domestic financial companies targeted not the main entrance but the side door, i.e., APIs (Application Programming Interfaces). Instead of the core computer network, which is heavily guarded with FDS (Financial Fraud Detection System) installed, they targeted the APIs of peripheral systems used by loan solicitors and others. The security industry expects API attacks, traditionally a vulnerable link, to increase further in the AI era, pointing out that comprehensive inspections are needed even for unmanaged IT assets.
According to the security industry on the 6th, as recent API attacks have increased, the need to manage unmanaged IT assets, known as 'shadow IT,' has emerged. The commonality among hacking damages at financial companies including KB Kookmin, Shinhan, Hana, BNK Busan Bank, Yegaram, Welcome Savings Bank, Hyundai Capital, PFCT, and Moudda is that they targeted the APIs of peripheral systems with relatively ambiguous management, such as web pages used by employees or loan solicitors. Consequently, not only the financial sector but also the e-commerce and telecommunications industries that have suffered hacking damages are re-inspecting IT assets exposed to the outside.
The vulnerability of API security is already known. Representative examples include BOLA (Broken Object Level Authorization) vulnerabilities, where APIs fail to properly verify object-level permissions, allowing access to other users' information. However, large-scale attacks had not appeared until now because the efficiency relative to effort was low. Since the accessible information and permissions differ for each API, hackers had to check vulnerabilities one by one.
Jo Hak-soo, an Information Security PM at the Institute of Information and Communications Technology Planning and Evaluation (IITP), explained, "Until now, the return obtained by hackers in terms of time and effort spent determining the validity of attacks for each API was low, but with the emergence of AI attack tools, it has become cost-effective from the hacker's perspective." In fact, Shinhan Bank, which suffered the greatest damage in this financial sector hacking, had a victim scale of approximately 25,000 people. While this is small compared to cases involving the leakage of personal information on the scale of tens of millions, the explanation is that if such information can be stolen at a cost of $1 through AI, it becomes a target worth attacking.
API attacks are expected to increase further in the future. According to Akamai's "2026 State of the Internet (SOTI) Report," daily average API attacks increased by 113% year-on-year in 2025. This is because as more companies utilize APIs, the number of APIs with unclear management responsibility or left neglected has also increased. Therefore, it has become important to clearly identify and use AI to screen 'shadow IT' assets that are relatively low in management priority or old enough that their management responsibility is not clear. Additionally, the importance of a 'zero trust' security strategy, which applies security from scratch without trusting everything, is emerging.
Kim Seung-ju, a professor at Korea University's Graduate School of Information Security, emphasized, "Identifying IT assets, from the number of PCs our company owns to unused APIs, is the top priority." He added, "Next, check if AI can defend against them, and since they can still be breached, we must prevent spread using a zero trust strategy."
Choi Dae-seon, a professor in the Department of Software at Soongsil University, also stated, "We must inspect the list of assets exposed to the outside, delete accounts of former employees and unused accounts, and apply multi-factor authentication and security patches." He added, "However, since AI attacks find loopholes at a speed that humans cannot keep up with, SMEs (small and medium-sized enterprises) should also introduce AI-based continuous inspections."
in TECH
