“Considering stronger CEO accountability over data leaks at 16 firms involving 100,000 records” ... Financial Services Commission (FSC) holds second emergency response meeting

[Financial News] The Financial Services Commission (FSC) held its second emergency response meeting to prepare measures in response to a series of cyberattacks targeting the financial sector. The FSC said that the results of self-inspections conducted by 555 financial companies by the 8th, found deficiencies at 130, and urged them to take immediate action.
As hacking attempts using artificial intelligence (AI) are increasing exponentially, the FSC is expected to move quickly to ease network-separation regulations in order to establish AI-based defenses. It will also pursue institutional reforms to strengthen the accountability of CEOs and boards, enabling financial companies to invest human and material resources in security.
At the second emergency response meeting, chaired by FSC Secretary General Shin Jin-chang on the 2nd, the government reviewed the checklist inspection results previously submitted by 555 financial companies.
The FSC, the Financial Supervisory Service (FSS) and the Financial Security Institute (FSI) dispatched on-site investigators immediately after recent hacking incidents at financial companies. They then took coordinated measures, including providing consumer protection guidance to customers whose information had been leaked, sharing attackers’ IP addresses across the financial sector and distributing checklists. Emergency meetings were also held on the 2nd and 4th, chaired respectively by the secretary general and the FSC chairperson, who called for a firm response from the financial sector.
A total of 16 companies across all sectors—including banks, savings banks, mutual finance institutions, specialized credit finance companies, electronic financial service providers, online investment-linked finance companies and virtual asset service providers—were confirmed to have suffered breaches around the time of the Shinhan Bank incident. Financial companies are still checking for additional breaches using shared IP addresses and other information, and the number of affected companies could rise further. So far, about 100,000 records have been identified as leaked, including names, contact details, resident registration numbers and email addresses. The FSC stressed, however, that it had found no evidence of leaks involving information that could enable direct fraudulent payments, such as account passwords or card numbers. In other words, there had been no cases of fraudulent remittances or similar incidents, which some had feared.
For financial companies that reported breaches, measures to prevent further damage—including blocking attackers’ IP addresses, applying security patches and suspending services—were swiftly implemented. Consumer protection measures were also taken, including informing customers of personal information leaks and providing guidance on how to respond.
The FSS and FSI are conducting on-site investigations into breach routes, attack methods, links between individual cases, whether the same actor was responsible, and the possibility of AI-enabled hacking. In cooperation with relevant agencies, investigations are also under way to prevent the damage from spreading to non-financial sectors and to apprehend the attackers.
The FSC’s inspection, completed by the 8th, covered 555 financial companies and a 12-item checklist. A total of 425 companies were assessed as “adequate,” while 130 reported some deficiencies. These were mainly related to unapplied security patches; inadequate management of systems whose manufacturers’ technical support had ended; the absence of real-time security monitoring; missing authentication or authorization for external systems; and the failure to adopt stronger authentication procedures for important services.
Deficiencies were particularly common among smaller companies with relatively limited security capabilities, such as electronic financial service providers and online investment-linked finance companies. Financial companies have begun corrective measures, including promptly applying security patches, replacing outdated equipment, expanding security monitoring staff and facilities, and broadening the scope of authentication.
The meeting discussed four policy tasks to strengthen security across the financial sector. First, comprehensive inspections of financial companies’ security frameworks and management systems will be carried out. The FSC plans to closely examine security management as a whole, including attack-surface management, authentication systems and internal controls, and guide companies in clearly setting and managing authentication and access-control permissions for external access points.
Next, to enable early detection of hacking threats and establish a joint response system, the FSC will improve systems so that financial companies can share threat information they identify themselves through an integrated monitoring system. The development of AI-based vulnerability assessment infrastructure will proceed in parallel.
To strengthen ongoing security management at financial companies, the FSC is considering increasing the frequency of vulnerability checks and assessments at large financial companies to at least twice a year, and including critical external access points among the mandatory inspection targets. It will also work to establish a basis for conducting ad hoc inspections when necessary.
Finally, to support small and midsize financial companies, the Financial Security Institute will consider a range of support measures with industry associations and central federations, including building an AI-based joint security monitoring system, conducting black-box tests and preparing customized security guides. It also plans to rapidly circulate response guidelines to sectors outside the scope of the Electronic Financial Transactions Act, such as moneylenders and insurance general agencies.
Emphasizing the importance of trust and safety in the financial sector, Secretary General Shin said, “Despite having called for comprehensive inspections and stronger management on numerous occasions in response to various events, including the Lotte Card data breach and the Mythos shock, it is deeply troubling to find cases where financial companies have failed to follow even basic practices.”
Secretary General Shin said, “Taking this incident as an opportunity, we will do our utmost to ensure a thorough reassessment and fundamental institutional reform across the entire security framework—not only in attack-surface management, such as the management of financial companies’ external access points and authentication, but also in the financial sector’s overall security monitoring system and in ensuring accountability for CEOs and boards.” He added, “To prepare for the growing threat of AI-enabled attacks, we will also carefully and swiftly pursue institutional reforms, including easing network-separation regulations, to establish a security framework in which ‘AI attacks are defended with AI.’”
[email protected] Park Mun-su Reporter