South Korea’s Financial Services Commission said hacking incidents had been confirmed at 16 financial firms, with about 100,000 cases of data leakage identified so far. The affected institutions span banks, savings banks, credit companies, electronic finance businesses and virtual-asset providers. The regulator said no leakage of account or card numbers carrying a direct risk of unauthorised payments had been confirmed. It cautioned that the number of affected firms could rise as checks continue.
The findings were released after a second emergency response meeting on 14 October involving financial supervisors, cybersecurity agencies, police and other authorities. Regulators examined security checklists completed by 555 financial firms and found shortcomings at 130 of them. Reported weaknesses included missing software patches, poorly managed unsupported systems, absent round-the-clock monitoring and incomplete multi-factor authentication. The firms were directed to begin remedial action immediately.
REGULATOR PLANS SYSTEM-WIDE INSPECTIONS
The commission said it would conduct comprehensive inspections of financial companies’ security systems and management controls. The planned work will map externally connected systems, tighten access rights and clarify reporting lines for chief executives, chief information security officers and chief information officers. The precise scope and timetable are to be agreed with the industry.
Authorities also plan to improve sector-wide sharing of threat intelligence and develop an AI threat-level system. The regulator said financial firms currently receive information through a central monitoring platform, but threats detected inside individual companies are not always shared. It also proposed AI-based infrastructure to test externally exposed assets, source code and mobile applications for weaknesses.
BANK LEADERS FACE GREATER ACCOUNTABILITY
South Korea will consider requiring large financial firms to assess vulnerabilities at least twice a year, compared with the current annual requirement for most systems. Officials will also examine powers for urgent inspections and measures to make board and executive responsibility more effective. Smaller firms could receive shared AI-based monitoring and tailored guidance through industry associations.
Investigators are still assessing whether the attacks were linked, whether one actor was responsible and whether AI was used. The next milestones will be the regulator’s inspection schedule, any attribution findings and further disclosures from affected firms. Those outcomes will determine whether the response remains supervisory or leads to enforcement action and new binding requirements.