A series of cyberattacks that began in the banking sector last month has spread to securities firms, insurers and the cryptocurrency industry, raising the threat across the financial sector. Recognizing the seriousness of the situation, financial authorities have strongly urged the boards of financial holding companies to strengthen information technology (IT) security.
According to financial industry sources on Oct. 28, signs of hacking incidents have emerged in succession at major financial investment firms and cryptocurrency exchanges, including Daishin Securities, Mirae Asset Global Investments and Bithumb. The companies have taken emergency measures, including blocking external internet protocol (IP) addresses, and said they had avoided intrusions into core networks and leaks of unique identification information.
Daishin Securities detected unauthorized access by a hacker on Oct. 17 to a server linked to its online account-opening system for discretionary investment management services. A detailed investigation found that names, addresses and other information belonging to 38,490 customers had been leaked. However, the company said account numbers, mobile phone numbers and other information were encrypted, and no signs of secondary damage had been detected.
“We take the leak of personal information very seriously and sincerely apologize to our customers,” said Jin Seung-wook, CEO of Daishin Securities.
Mirae Asset Global Investments also detected unauthorized access to some of its web systems and implemented blocking measures through a web application firewall (WAF). The company emphasized that the affected systems were not services intended for general investors and that no sensitive information, including resident registration numbers, had been leaked. Earlier, on Oct. 26, Mirae Asset Life Insurance also disclosed a leak of personal and credit information.
Bithumb confirmed a breach of its internal mobile groupware system and is analyzing the extent of the data leak. So far, only employee information is believed to have been compromised.
Despite the measures taken by individual financial institutions, concerns remain over secondary damage. Even unencrypted data such as names and email addresses could be exploited for additional financial crimes, including targeted spear-phishing attacks impersonating financial institutions.
As a series of attacks continues to target external connection servers and employees' internal work systems rather than the more tightly secured core networks of banks, financial authorities have stepped up their response.
Lee Chan-jin, governor of the Financial Supervisory Service (FSS), held a meeting with the board chairpersons of eight banking holding companies at the agency's headquarters in Yeouido, Seoul, on Oct. 28. Lee expressed concern that simultaneous attacks using artificial intelligence (AI) could become a persistent threat and urged financial institutions to establish proactive defense systems as quickly as possible.
The National Security Office held an emergency inspection meeting on the response to a series of cyberattacks targeting the financial sector that day, chaired by Song Ki-ho, third deputy director of the National Security Office. Officials from the Financial Services Commission (FSC), Ministry of Science and ICT (MSIT), Personal Information Protection Commission (PIPC), Financial Security Institute (FSI) and Korea Internet & Security Agency (KISA) attended the meeting.
Participants reviewed the progress of investigations and response measures for each incident. They also discussed measures to prevent secondary damage, including smishing and voice phishing that exploit leaked information, as well as plans to inspect potential attack routes such as external connection servers and internal business systems. The participating agencies agreed to cooperate closely by sharing information on attacks and investigation findings in real time.
“Because hacking in the financial sector is directly linked to people's assets and trust in the financial system, I ask that you make every effort to respond swiftly and prevent secondary damage,” Song said.
“In particular, please devote all available efforts to strengthening security so that institutions with limited cybersecurity resources, including small and medium-sized financial companies, do not become security blind spots,” he emphasized.
Cheong Wa Dae also urged the public to “exercise particular caution regarding phone calls and text messages impersonating financial institutions and other organizations.”
Separately, the FSS held a meeting with the board chairpersons of eight banking holding companies at its headquarters in Yeouido, Seoul, expressing concern that simultaneous AI-powered cyberattacks could become increasingly routine. Lee urged financial institutions to quickly establish proactive defense systems capable of actively identifying and eliminating vulnerabilities, as hacking techniques evolve and attackers increasingly expand their targets to noncore facilities.
Lee also criticized practices in which financial institutions merely comply with regulatory requirements as a formality or neglect to allocate sufficient resources because they view security investments as costs.
He added that boards of directors should take the lead in strengthening defensive capabilities to protect customers' assets and maintain trust in the financial system.
