Financial authorities tighten breach checks and consider shared AI monitoring

The FSS said it was checking whether financial companies implement security improvement plans after identifying vulnerabilities through self-inspections.[1] Authorities are conducting on-site inspections and audits, beginning with firms that experienced major data breaches.[1] The Financial Services Commission (FSC) plans to hold an AI-hacking response inspection meeting on November 5.[1] Participants are expected to include the FSS, the Financial Security Institute, government agencies, industry associations and CEOs of the five largest banks.[1] Authorities plan to announce financial-sector security measures based on the meeting’s results.[1]

At the time of the meeting, authorities had confirmed recent data breaches at 16 financial companies and estimated that about 100,000 pieces of customer data were affected.[3] They said no reported incident had involved account-password or credit-card-number data.[3] All 555 companies completed a 12-point cybersecurity checklist: 425 said their measures were appropriate, while 130 reported areas needing improvement.[3] Reported shortcomings mostly concerned security patches or control systems.[3] Authorities said deficiencies appeared more often in electronic financial services and online peer-to-peer lending than in more traditional sectors.[3]

Since late September, incidents were reported at Shinhan, KB Kookmin, Hana and BNK Busan banks, as well as Ye Garam, Welcome and OK Savings Banks and Hyundai Capital.[1] Authorities later confirmed hacking damage at Daishin Securities, Bithumb and Mirae Asset Global Investments.[1] About 50,000 cases of personal information were leaked from Ye Garam Savings Bank; the FSS began a 10-day on-site inspection there on October 13 and requested an improvement plan.[1] KB Kookmin first reported 119 people affected by leaked personal information, then identified another 2,091 victims.[1] The FSS extended its inspection to investigate the circumstances of that breach.[1]

Authorities are considering a joint AI-based security monitoring system organized around financial-sector associations as a response to potential widespread AI-driven attacks.[2][1] Recent attacks may have involved AI agents autonomously identifying and infiltrating vulnerabilities, according to the report.[1] Authorities said they plan exhaustive inspections of cybersecurity management systems and want threats identified by individual companies to be reported quickly to regulators and shared with other firms.[3] They will also seek a regulatory basis for more frequent, regular vulnerability testing and consider expanding cybersecurity-management support for small and midsize financial companies facing AI-driven risks.[3]