South Korea is planning stricter cybersecurity rules for banks, cryptocurrency businesses and other financial companies after confirming security incidents at 16 institutions. Authorities estimate that around 100,000 pieces of customer information were exposed, while an industrywide review found security weaknesses at 130 of 555 companies.
The Financial Services Commission (FSC) announced the proposed changes on October 14 after an emergency meeting in Seoul to review the recent cyberattacks and the results of a wider security inspection.
The plans include more frequent vulnerability checks, stronger threat monitoring and clearer responsibility for company executives when security requirements are not met.
South Korea finds security weaknesses at 130 financial companies
The FSC completed a cybersecurity review of 555 financial companies using a 12-point checklist by October 8. Of these, 425 reported that they met the requirements, while 130 identified problems that needed to be addressed.
Most affected companies had weaknesses in one or two areas. These included outdated security software, weak monitoring systems and insufficient protection for computer systems accessible from outside their networks.
Some companies had failed to install the latest security updates or were still using systems that no longer received support from their manufacturers.
Inspectors also found gaps in continuous security monitoring and access controls. In some cases, important systems lacked stronger authentication measures, such as multifactor authentication.
Electronic financial service providers and online lending businesses reported relatively high numbers of shortcomings. The FSC said these companies may have fewer resources available for cybersecurity than larger financial institutions.
Companies with identified weaknesses submitted plans to fix them. Their measures included installing updates, replacing outdated equipment, improving monitoring and limiting access to sensitive systems.
However, the 130 companies with security weaknesses were not all confirmed victims of cyberattacks. The regulator separately identified actual security incidents at 16 financial businesses.
Two cryptocurrency businesses were among the affected firms
The confirmed incidents involved four commercial banks, four savings banks, lending and capital companies, electronic financial service providers, online investment businesses and two cryptocurrency-related businesses.
The digital asset companies included Streami, which operates the Gopax cryptocurrency exchange, and Prabang, identified by the FSC as a virtual asset service provider.
The affected banks included Shinhan Bank, KB Kookmin Bank, Busan Bank and Hana Bank. The savings banks were Yegaram, Welcome, DB and OK.
Other businesses named by the regulator included Hyundai Capital, KDB Capital, PFCT, Mouda and the Korea Federation of Community Credit Cooperatives.
Authorities estimate that approximately 100,000 pieces of customer information were exposed. The affected data included names, telephone numbers, email addresses and South Korean resident registration numbers.
The FSC said investigators had not confirmed that account passwords or payment card numbers had been exposed in a way that would directly enable unauthorized transactions.
Following the incidents, regulators instructed affected companies to block suspicious IP addresses, install security patches and suspend vulnerable services when necessary. Customers whose information was exposed were also to receive notifications and guidance on protecting themselves.
The Financial Supervisory Service and the Financial Security Institute are continuing to investigate how attackers accessed the affected systems. They are comparing technical evidence to determine whether the incidents involved the same individuals or groups.
Authorities have not established whether artificial intelligence was used in the attacks.
South Korea has also investigated separate security incidents involving crypto exchanges. In July, the Financial Supervisory Service began sanctions proceedings against Dunamu, the operator of Upbit, over an earlier wallet breach. The regulator has not linked that case to the latest group of incidents.
Larger financial institutions could face twice-yearly security checks
The FSC wants to increase the frequency of cybersecurity assessments, starting with larger financial institutions.
Financial companies generally undergo vulnerability assessments once a year, although twice-yearly checks already apply to external websites. Under the proposed changes, larger institutions with extensive external connections and customer bases could be required to undergo assessments at least twice a year.
Regulators are also considering additional inspections outside the regular schedule when serious threats emerge.
The expanded reviews would examine external connections, authentication procedures, internal controls and the systems used to access sensitive information. Companies could also face clearer requirements for documenting which employees and services have access to their networks.
The FSC plans to define responsibilities more clearly for chief executive officers, chief information security officers and chief information officers.
Regulators are reviewing ways to strengthen accountability when companies ignore required security measures or fail to address problems identified during inspections.
The commission has not yet announced a final implementation date. Further consultations with financial industry representatives will determine the inspection schedule and which institutions will be covered.
South Korea plans AI-based tools to detect cyber threats
Alongside stricter inspections, the FSC wants financial companies to share information about cyber threats more effectively.
The Financial Supervisory Service and Financial Security Institute currently distribute threat information through an integrated monitoring platform known as FIRST. However, information detected by individual companies is not always shared consistently across the industry.
The regulator plans to expand the system so financial institutions can report newly discovered threats and help other companies respond before similar attacks spread.
It is also preparing an AI-based threat monitoring framework that would classify the severity of detected risks and distribute relevant information to financial firms.
The proposed tools could use AI to examine externally exposed computer systems, internal software code and mobile applications for security weaknesses. Smaller companies may also receive access to a shared AI-based monitoring service developed with financial industry associations.
The Financial Security Institute will assess the proposed service and prepare guidance for businesses with limited cybersecurity resources.
At the October 14 meeting, FSC Secretary General Shin Jin-chang criticized financial companies for failing to follow basic security requirements despite repeated warnings.
He said it was “very painful” to discover these shortcomings after earlier financial security incidents had already prompted calls for stronger protections.
Shin called for better controls over external connections, authentication, monitoring systems and executive accountability. He also said the regulator would pursue an approach designed to “defend against AI attacks with AI.”
Regulators warn customers about phishing and fraudulent loans
Before announcing the latest cybersecurity proposals, South Korean regulators had already warned consumers about the possible misuse of information stolen during financial sector breaches.
On October 6, the FSC and Financial Supervisory Service issued a Level I caution notice warning customers about phishing attempts and fraudulent loan applications. The agencies launched a special response period lasting one month.
During this period, financial companies were instructed to help affected customers and strengthen monitoring for suspicious account openings, loan applications and large transfers.
Authorities also directed firms to use the AI-based anti-phishing Sharing and Analysis Platform, known as ASAP, to share information about suspected fraud.
Companies were told to request additional identity verification when suspicious activity suggested that stolen customer information might be involved.
At the time of the October 6 warning, regulators had not confirmed financial losses caused by phishing or unauthorized transfers using information exposed in the recent breaches.
The agencies said they could raise the consumer alert from Level I to Level II if financial damage linked to the stolen information was confirmed.
The latest proposals aim to strengthen both prevention and response, with more frequent inspections, improved threat sharing and clearer accountability across South Korea’s financial sector.
