Data Leaks Hit 37 Financial Firms Totaling 473,000 Cases... KRW 1 Billion Siphoned

Over the past month, approximately 473,000 cases of information leaks have been identified across 37 financial institutions in the financial sector.

The amount of funds siphoned off stands at around KRW 1 billion.

On November 5, Financial Services Commission (FSC) Chairman Lee Eok-won presided over a joint meeting with the Financial Supervisory Service (FSS), the Financial Security Institute (FSI), heads of associations across the entire financial sector—including virtual assets, electronic finance, and online-linked peer-to-peer (P2P) lending—and relevant ministries to discuss security system innovation in the age of artificial intelligence (AI) and review the current situation.

Following the confirmation of the first security breach on September 30, a total of 40 breach reports were filed by 37 companies through November 3.

These include 4 banks, 5 financial investment firms, 3 insurance companies, 5 savings banks, 1 mutual finance company, 2 credit finance firms, 4 online P2P lending firms, 10 electronic finance companies, and 3 virtual asset service providers.

After completing checklist inspections on October 14, reports continued to pour in mainly from small and medium-sized securities and insurance firms, electronic finance companies, online P2P lenders, and the virtual asset industry.

The leaked information includes employee details, customer names, resident registration numbers, and account numbers. The FSC explained that leaks of information susceptible to unauthorized payments, such as account passwords, have not yet been confirmed.

Funds managed by companies—such as hot wallets storing digital assets while connected to the internet, consumer points, and online P2P lending deposits—were primarily siphoned from small-scale virtual asset exchanges, electronic finance companies, and online P2P lenders.

However, authorities are currently assessing that actual fund losses for individual users have not yet materialized.

Financial authorities are guiding and supervising consumer protection measures based on the Electronic Financial Transactions Act and the Virtual Asset User Protection Act.


Financial authorities are launching security vulnerability inspections and institutional improvements.

Comprehensive inspections will cover approximately 580 companies, including traditional financial institutions as well as electronic finance companies, online P2P lenders, and the virtual asset industry, which is not currently subject to the Electronic Financial Transactions Act.

The inspections will also review internal control operations, such as the roles and responsibilities of chief executive officers (CEOs), chief information security officers (CISOs), and chief information officers (CIOs) at financial institutions, as well as decision-making procedures in managing external touchpoints.

Authorities plan to complete inspections of systems listed in management ledgers by November 30, and conduct a full investigation of unlisted systems and internal control systems by the end of the year.

While financial institutions will conduct self-inspections, the FSS and FSI will carry out on-site inspections if self-assessments are deemed substandard or if critical vulnerabilities are discovered.

During the comprehensive inspection process, authorities plan to handle vulnerabilities or past management negligence flexibly on the condition of immediate remedial measures, but take strict enforcement actions against any security breaches that occur after the comprehensive inspections.

Chairman Lee stated, "We will not tolerate behaviors that cause accidents or exacerbate damages due to formal inspections, complacent responses, or knowing and neglecting security risks while ignoring even basic management." He added, "We will strictly hold management, including CEOs, accountable for serious management negligence or regulatory lapses in accordance with relevant laws and regulations."

The joint financial sector hacking monitoring system will be upgraded.

The Integrated Monitoring System (FIRST) will be enhanced to support large financial institutions and will undergo a pilot operation next month, before being rolled out for use across the entire financial sector in the first quarter of next year.

To ensure virtual asset businesses—which are not covered by the Electronic Financial Transactions Act—report immediately not only to the Korea Internet & Security Agency (KISA) but also to the FSS and FSI, reporting response guidelines will be established within this month.

Additionally, large financial institutions will be required to shorten their vulnerability analysis and evaluation cycles to twice a year and mandate the inclusion of all external touchpoints in evaluation targets.

Authorities also plan to enable random ad-hoc evaluations in urgent situations and push for corrective orders alongside continuous compliance penalties for non-compliance.

Small and medium-sized financial institutions will be provided with the Financial Security Institute's one-stop AI defense service and customized security guidebooks, followed by phased warning systems and behavioral guidelines.

To prevent secondary damage, the distribution of personal information on the dark web and other channels will be monitored and blocked.

The Anti-Scam Analysis Platform (ASAP)—a joint financial sector voice phishing information sharing and analysis platform—will be upgraded to rapidly detect and freeze criminal accounts, while an AI-based "Suspicious Transaction Index" will be piloted starting this month.

Joint detection rules targeting criminal methods such as burner accounts and emerging scams will also be incorporated into ASAP.

Legislative support will be actively provided for amending the Special Act on Prevention of Losses from Telecommunications-based Financial Scams to introduce a strict liability system where financial institutions compensate a portion of voice phishing damages.

To build an AI-based security system, a "Task Force for Complete Lift of Network Separation Regulations" will be launched in earnest to formulate concrete measures.

Current regulatory easing for network separation aimed at utilizing AI and SaaS for security purposes, which is being processed through no-action letters, will be institutionalized on a regular basis, and network separation easing via innovative services will also be pursued.

Authorities plan to formulate a "Digital Finance Safety Act" within the first quarter of next year to establish computer security rules across the entire financial sector.

Security regulations at the level of the Electronic Financial Transactions Act will be applied to virtual asset service providers and corporate insurance general agencies (GAs), while third parties such as cloud service providers and platforms will also be regulated.

(Photo: Yonhap News)
※ Please note: This article was translated by AI and may contain errors.