A series of hacks targeting the financial sector has resulted in confirmed security incidents at 16 financial companies and the leakage of about 100,000 items of information, authorities found. After an emergency inspection of 555 financial firms, the financial authorities also confirmed inadequate security management at 130. The Financial Services Commission will push institutional improvements across the sector's security framework, including strengthening security-management accountability for chief executives and boards.

The Financial Services Commission on Oct. 14 held the second emergency response meeting chaired by Secretary-General Shin Jin-chang (신진창), attended by the Financial Supervisory Service, the Financial Security Institute and relevant ministries, to discuss the findings of investigations into security incidents in the financial sector and measures to strengthen security management.

So far, a total of 16 financial companies have had security incidents confirmed, including banks, savings banks, mutual financial institutions, specialised credit financial businesses, electronic financial businesses, online investment-linked finance and virtual asset businesses. The leaked information totals about 100,000 items, including names, contact details, resident registration numbers and email addresses.

The financial authorities explained that they have not confirmed the leakage of information that could raise concerns about direct fraudulent payments, such as account numbers and card numbers. They are investigating whether there were additional intrusions, meaning the number of affected financial companies could rise.

SECURITY LAPSES FOUND AT 130 OF 555 FINANCIAL FIRMS

The financial authorities checked a 12-item security checklist for 555 financial companies through Oct. 8. They said 425 reported their status as adequate, while 130 submitted some shortcomings.

Key shortcomings included failure to apply the latest security patches, poor management of systems whose manufacturers have ended technical support, lack of a 24-hour security monitoring system, and weaknesses in authentication and access controls for external access systems.

They explained that relatively more shortcomings were found in the electronic financial business sector and the online investment-linked finance sector.

The financial companies concerned have submitted remediation plans and are taking steps such as applying security patches, replacing aging equipment and expanding security monitoring staff and facilities.

TIGHTEN CEO AND BOARD SECURITY RESPONSIBILITY, EXPAND INSPECTION DUTIES

In response to the incidents, the financial authorities decided to strengthen the security-management responsibility of financial company CEOs and boards. They also plan measures to increase the effectiveness of sanctions so that recommended security checks are carried out in practice.

They made the decision after judging that cases have been identified in which even basic security management was not carried out despite repeated calls on the financial sector to strengthen security inspections and management.

They will first push for a comprehensive inspection of overall security management systems, including external touchpoints and authentication and access controls for financial companies' IT systems, as well as internal controls. They also plan to clarify security reporting lines and the scope of responsibility for CEOs, chief information security officers and chief information officers.

They are also pushing a plan to expand the cycle for checking and assessing security vulnerabilities at large financial companies to at least twice a year, from the current once a year. They will include key external touchpoints as mandatory inspection targets and review a basis for conducting ad hoc inspections when urgent security threats arise.

STRENGTHEN RESPONSE TO AI-BASED HACKING; REVIEW JOINT MONITORING FOR SMALLER FIRMS

The authorities will improve an integrated monitoring system so that hacking-threat information identified by each financial company can be shared across the sector. Threat information collected by the Financial Supervisory Service and the Financial Security Institute is currently shared, but information detected independently by individual financial companies is not shared.

The financial authorities plan to build an AI-based threat-level information system and vulnerability inspection infrastructure. They also plan to review the introduction of a joint security monitoring system for small and mid-sized financial firms, with participation from the Financial Security Institute and industry associations and federations by sector.

They also plan to prepare measures to strengthen security management for lenders and insurance general agencies, which are excluded from the scope of the Electronic Financial Transactions Act.

Shin Jin-chang, the Financial Services Commission's secretary-general, called it "very painful" that cases were found in which basic parts were not properly observed at financial companies despite repeated calls for comprehensive inspections and stronger management. "We will secure accountability for CEOs and boards and push fundamental institutional improvements across the overall security system," he said.