Lee Chan-jin: “Will verify Woori and NongHyup’s defenses against hacking; preparing to bring the Bug Bounty Program up to KISA’s level”

[Financial News] Lee Chan-jin, governor of the Financial Supervisory Service, said he would verify the defense methods used by Woori Bank and NH NongHyup Bank, neither of which has had an information leak confirmed so far, in connection with recent hacking incidents in the financial sector. He also said he would prepare a plan to strengthen the ‘Bug Bounty Program,’ which rewards people for finding and reporting security vulnerabilities, to the level of the Korea Internet & Security Agency (KISA).
Asked by Han Min-su of the Democratic Party of Korea at a National Assembly Political Affairs Committee audit of the Financial Supervisory Service and other institutions on the morning of the 19th about the difference between banks that had suffered data leaks and those that had not, Governor Lee replied, “Because they stayed true to the fundamentals.” He added, “Woori Bank had a multi-factor authentication system, while NongHyup Bank had no points of access exposed to external attacks.”
Woori Bank has said it uses designated tablet devices and requires smartphone authentication through a WON certificate to access its system, while NH NongHyup Bank has said it does not operate a separate external support system for loan solicitors.
When Rep. Han asked whether the explanations from the two banks had been verified, Governor Lee replied, “I’ll look into it.” Han said, “If the two banks’ explanations are correct, that means their measures are effective,” and called for standard criteria that other banks could also refer to.
Calls also continued for the financial sector to strengthen its defensive capabilities in preparation for increasingly sophisticated attacks using AI. Han pointed out that the addition of new business systems to existing bank IT networks had increased the points of access for external attacks. He stressed that banks’ security systems and defensive capabilities needed to be strengthened, particularly as fast, repeated attacks using artificial intelligence (AI) could become more widespread. Governor Lee replied, “We are preparing for this.”
There were also calls for further verification of the results of security inspections at financial companies. Han noted that 130 of the 555 companies inspected, or 23.4%, had been rated inadequate, and said the Financial Supervisory Service should verify whether the remaining 425 companies were in fact free of vulnerabilities or other problems. Governor Lee replied, “We are conducting a comprehensive survey of the exposed attack surface.”
The need to promote the financial sector’s vulnerability reporting reward program, the ‘Bug Bounty Program,’ was also raised. Han urged the sector to increase both the frequency of the program and its rewards. KISA has operated the program since 2012; in 2024, 33 companies took part and 1,786 vulnerability reports were received. The total rewards amounted to 276.69 million won.
By contrast, the Financial Supervisory Service and the Financial Security Institute operate the program once a year, with participation limited to 22 companies. Their rewards total 44.2 million won, about one-sixth of KISA’s.
Han said, “Wouldn’t running it just once a year leave gaps?” and added, “We need to increase how often it is run and make good use of the existing program.” Governor Lee replied, “We will prepare to bring it up to KISA’s standards.”
[email protected] Lee Hyun-jung Reporter