[Editorial] Hacking of the financial sector even via North Korean IP addresses must be treated as a national security issue

Hacking incidents that began in the banking sector have spread across the board, from savings banks, capital finance companies and virtual assets to insurance and financial investment firms. Attempts to access South Korea’s financial systems via North Korean Internet Protocol (IP) addresses have also been detected. Attacks exploiting a serious security vulnerability in PHP, a website development language, have targeted systems in several countries, including the United States and South Korea, prompting cybersecurity alerts worldwide.
Hacking incidents continued unabated over the past month. After about 100,000 personal data records were leaked at 16 financial companies from early to mid-month, incidents followed at securities firms, asset managers and virtual asset exchanges, as well as airlines and travel platforms. Signs of artificial intelligence (AI) use were detected, and a common feature also emerged: vulnerable websites connected to external networks were used as attack routes.
Financial regulators have completed security checks at 555 financial companies, but critics say the checks lack effectiveness because they rely on companies’ own assessments and cover only 12 items. With hacking incidents recurring, it is difficult to identify vulnerabilities properly through such checks alone. Regulators should go beyond reviewing the results and verify whether security systems are actually working as intended.
Attempts to access systems via North Korean IP addresses have also been detected. According to the Financial Security Institute, more than 4.4 million scanning attempts targeting South Korea’s financial systems were detected over a 24-hour period starting at 3 a.m. on the 21st, originating from multiple ranges of North Korean IP addresses. A third-party attacker may have spoofed North Korean IP addresses, so the activity cannot be conclusively attributed to North Korea. Still, the related indications cannot be dismissed lightly.
Attacks exploiting PHP vulnerabilities are also raising concerns. On the 23rd and 24th, signs were detected that the highest-level administrator privileges had been compromised on 25 servers, including systems related to the U.S. government. Firewalls in South Korea, as well as in the United States, Japan and Taiwan, were also among the targets. Possible links to China and signs of AI use have also been raised, but whether domestic systems were actually breached and the scale of the resulting damage have yet to be confirmed.
The problem is that information security capabilities are not keeping pace with increasingly sophisticated threats. The government is inspecting around 170 critical facilities in sectors such as finance, telecommunications and platforms, but continues to do little more than repeat investigations and inspections after each incident. Cases have also emerged of financial companies increasing their information technology (IT) investment without sufficiently expanding information security investment, or reducing the number of dedicated security staff. The same situation keeps recurring: even the attackers and their motives remain unidentified. Above all, the mindset that treats security merely as a cost must change.
The national cyber response system must also be fundamentally overhauled. The public and private sectors should establish a system to share information on emerging threats in real time and respond jointly. Authorities should also assess whether security investment and skilled personnel are being secured in line with the expansion of digital services. Companies and institutions, too, should build stronger defenses through measures such as abnormal transaction detection, multifactor authentication and round-the-clock security monitoring. It is urgent to move away from relying on investigations and penalties after incidents and shift to a response system focused on prevention.