OK Savings Bank Hacked Again Three Days After Emergency Response; Data of 268 Customers Leaked

[Financial News] OK Savings Bank suffered another hacking attack and customer information was leaked just three days after it became aware of the data breach and began an emergency response. This time, a page related to its mobile deposit service, rather than the loan application webpage, was breached, exposing financial information, including account numbers and balances, belonging to 268 customers. The total number of customers affected by data leaks at OK Savings Bank has now risen to 518.
On the 16th, OK Savings Bank said it had confirmed that information belonging to 268 customers who used its mobile deposit service had been leaked the previous day.
Earlier, OK Savings Bank detected abnormal access to its loan application webpage on the 12th, and personal information belonging to 250 customers was leaked in that incident. It subsequently completed measures to block suspicious IP addresses and access routes, and has been conducting a thorough investigation of its systems as a whole, including deposit and banking services.
During this process, it confirmed abnormal access to a page related to its mobile deposit service and an additional data leak. The attack lasted 4 hours and 2 minutes, from 3:32 a.m. to 7:34 a.m. on the 15th. The leaked information included customers’ names, account numbers, product names, balances, interest rates and dates of their most recent transactions.
OK Savings Bank confirmed the additional leak at 10 a.m. that same day. At 10:59 a.m., it blocked the suspicious IP address and access route, and at 1:52 p.m. it urgently implemented protective logic for its account inquiry service. At 5:10 p.m., it added a shared protective mechanism for session management, and at 8 p.m. it applied a solution to detect and block abnormal activity.
Afterward, OK Savings Bank completed the required filing with the Financial Supervisory Service regarding the electronic financial incident, in accordance with relevant procedures, and notified customers whose personal information had been leaked via text message and email. 
OK Savings Bank said, "We plan to provide guidance on measures to prevent secondary harm and operate a consultation center to help customers report damage and seek advice on complaints." It explained that there had been no further new abnormal access since the security measures were implemented.
A representative of OK Savings Bank said, "We completed our emergency response after becoming aware of the initial data leak on the 12th, but discovered an additional leak while conducting a comprehensive re-examination of our systems," and added, "We once again offer our deepest apologies for causing concern to our customers who have placed their trust in us."
Meanwhile, the leak of customer information from another service even as emergency response and a thorough investigation into the earlier incident were underway is expected to fuel concerns about the effectiveness of subsequent security measures.

[email protected] Lee Hyun-jung Reporter