South Korea has confirmed security incidents at 16 financial companies, including two cryptocurrency businesses, following recent cyberattacks. According to reports from the Financial Services Commission (FSC), the breaches exposed approximately 100,000 customer records, including names, contact details, and South Korean resident registration numbers. The affected institutions include four commercial banks (Shinhan Bank, KB Kookmin Bank, Busan Bank, and Hana Bank), four savings banks (Yegaram, Welcome, DB, and OK), and various lending companies and electronic financial service providers. Among the digital asset businesses affected were Streami (operator of Gopax cryptocurrency exchange) and Prabang (identified as a virtual asset service provider). The latest developments show that five additional companies were newly identified as having suffered breaches: DB Savings Bank, KDB Capital, Brightfix, Streami, and Prabang.
The FSC announced that authorities are conducting an in-depth investigation into the cyberattack methods to determine whether artificial intelligence (AI) was involved in the breaches. According to the FSC, financial authorities are examining how the hacking incidents occurred and whether AI played a role in the attacks. The investigation centers on identifying the techniques that the hackers applied and possible vulnerabilities in the affected organizations' security systems. The FSC completed a comprehensive review of 555 financial companies using a 12-point cybersecurity checklist by October 8. As reported by the FSC, 425 companies reported that their security measures met the checklist requirements, while 130 identified problems requiring correction. Common failures included outdated security software, weak monitoring systems, and insufficient protection for externally accessible computer systems.
Following the inspection results, the FSC outlined plans to increase cybersecurity assessment frequency, beginning with large financial institutions. According to the FSC announcement, larger institutions could face vulnerability checks twice yearly under the proposed reforms, compared to the current requirement of once per year. The regulator plans a more detailed review covering external connections, authentication procedures, and internal controls. Under the proposed arrangements, firms would need clearer records of how external systems connect to their networks and which employees or services can access sensitive information. The FSC also plans to improve threat reporting through an AI-based monitoring framework and shared AI-based monitoring services for smaller companies. Authorities are also considering having the Financial Security Institute work with sector associations and federations to build a joint security monitoring system to strengthen defenses at smaller financial firms.
Following the incidents, regulators instructed affected firms to block IP addresses associated with suspicious activity, apply security patches, and suspend vulnerable services when necessary. As reported by the FSC, customers whose information had been exposed were to receive notification and guidance on protective measures. The agencies issued a Level I consumer alert on October 6, warning customers about phishing attacks and fraudulent loan applications, with a one-month special response period. During this period, financial companies were instructed to provide assistance to affected customers and strengthen monitoring of suspicious account openings, loan applications, and large transfers. The regulator said it would raise the consumer alert from Level I to Level II if subsequent financial damage involving stolen information was confirmed. Some companies disclosed the scale of their individual losses, with KDB Capital reporting that 848 customers' names, resident registration numbers and dates of birth were exposed, while Prabang confirmed that contact details and addresses of 20 users were leaked.
FSC Secretary General Shin Jin-chang criticized financial companies that had failed to follow basic cybersecurity requirements despite repeated warnings. According to the FSC, Shin called for improvements covering external connections, authentication procedures, monitoring systems, and executive responsibility. The commission plans to pursue a system intended to "defend against AI attacks with AI." The FSC announced that it would conduct security inspections at financial firms as part of its response to the incidents. The regulatory body will also develop means through which hacking dangers will be identified early enough and there will be an organized reaction to any cyber dangers. The planned inspections and early-warning measures are intended to strengthen security across the financial sector and improve coordination when threats emerge. Following a second emergency response meeting held on October 14 at the Government Complex Seoul, regulators confirmed plans to fundamentally overhaul security management across the industry.
