Following a series of hacking incidents that exposed customer information at major banks, including Shinhan, KB Kookmin, Hana, and Busan Bank, the financial sector is on high alert. On October 4, financial authorities convened an emergency meeting to address the breaches, which have raised concerns about the potential for automated attacks using artificial intelligence (AI). Protecting customer funds and information is a fundamental responsibility of financial institutions. Authorities and the financial sector must thoroughly investigate the infiltration routes and management failures, and reassess the entire security framework.
A key point in this incident is that the attack targeted not only customer-facing financial transaction systems but also internal systems used by loan brokers and employees. While security efforts focused on the main entry points, customer information slipped out through less monitored channels. The argument that these systems are separate from transaction systems cannot absolve responsibility. Any system that can access customer information must have appropriate protective measures in place. Managing external access routes and the permissions of third-party vendors is essential for comprehensive financial security.
The specifics of the attack method and the use of AI must be clarified through investigation. However, it is clear that organizations must prepare for attackers who can quickly identify and exploit vulnerabilities. Merely installing security software and conducting regular checks is insufficient. Institutions need to identify which systems are exposed to the outside and restrict access and information retrieval to necessary levels. They must immediately detect and block abnormal repeated queries and promptly address any discovered vulnerabilities. A system that continuously verifies whether security measures are effective against actual attacks is necessary.
It is also important to note that some financial institutions successfully prevented information leaks despite being attacked. The targets and intensity of the attacks may have varied, so it is unwise to hastily conclude the security levels of different companies. Authorities should compare the access controls, authentication, and detection processes of affected and defending companies to identify factors that contributed to their success or failure. Effective defensive measures should be quickly shared across the financial sector, and checks should be made to see if similar vulnerabilities exist in other companies. This situation cannot be resolved merely by tallying incidents and issuing uniform inspection directives.
Financial institutions invest substantial amounts annually in information security. However, the size of the investment does not guarantee safety. It is crucial to assess whether personnel and budgets are allocated effectively and whether controls have not been loosened for operational convenience. Management must move away from the practice of delegating security to IT departments and only receiving reports after incidents occur. They should ensure that security capabilities keep pace with business expansion and digital transformation, and they must be accountable for improvements identified during inspections. Authorities should also verify actual defensive capabilities rather than just compliance on paper.
Urgent action is needed to prevent secondary damage from leaked information. Authorities have stated that there is currently no evidence that the leaked information has been used for fraudulent transactions. However, customers cannot be reassured. If names and contact information are combined with income and loan data, it could be exploited for targeted scams impersonating financial institution employees. Financial institutions must clearly communicate the details and scope of the leaked information and establish procedures for reporting and remedying incidents disguised as damage verification or compensation.
Finance operates on trust. Repeated personal information leaks can undermine trust not only in individual companies but also in the digital finance sector as a whole. It is essential to address the vulnerabilities of large financial institutions while also enhancing the response capabilities of smaller institutions that may lack resources. This incident should not be treated as a one-time emergency review. A system must be established to manage all access routes, quickly detect breaches, and prevent customer harm.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.