Hacking incidents targeting financial companies, including securities firms, continue unabated. Even the Financial Security Institute, which supports security in the financial sector, has been exposed to hacking. Amid escalating hacking threats, it has been revealed that eight out of ten securities firms do not disclose any information regarding personal data protection measures.
According to the Korea Financial Investment Association and the Korea Internet & Security Agency (KISA), only 10 out of 60 domestic securities firms, or 16.7%, have disclosed information on their cybersecurity investments, workforce status, and relevant certifications. When narrowing the scope to the top 10 securities firms by equity capital, only six—Korea Investment, Shinhan Investment, NH Investment, KB, Hana, and Daishin Securities—participated in the disclosure.
Among the firms that disclosed their cybersecurity investments, Korea Investment Securities reported the highest expenditure at 18.8 billion won, followed by Shinhan Investment Securities at 17.1 billion won, NH Investment Securities at 12.4 billion won, KB Securities at 12.2 billion won, Hana Securities at 10 billion won, and Daishin Securities at 5.6 billion won.
In contrast, Mirae Asset Securities and Kiwoom Securities provided limited information through their ESG management reports. Mirae Asset Securities indicated that the proportion of cybersecurity investment relative to its IT investment was about 10% last year, while Kiwoom Securities reported 7.32%. Samsung Securities and Meritz Securities did not provide any such information.
Among the four firms—Daishin, Shinhan Investment, Korea Investment, and NH Investment—that disclosed their personal data protection status, the ratio of security investment to average operating profit growth decreased from 3.46% the previous year to 1.76% last year. During the same period, the average operating profit growth for these four firms reached 118.5%.
Specifically, Daishin Securities reported a consolidated operating profit of 301.4 billion won last year, a 260.5% increase from the previous year, but its cybersecurity investment decreased by 1% to 5.586 billion won. Although the proportion of cybersecurity investment relative to total IT investment slightly increased from 8.2% in 2024 to 8.3% last year, this was due to a more significant reduction in overall IT investment. Recently, Daishin Securities experienced a data breach affecting the personal and credit information of 38,490 customers.
Korea Investment Securities also saw an 82.5% increase in operating profit compared to the previous year, but its cybersecurity investment only rose by 12.5%. The number of dedicated cybersecurity personnel decreased from 41.7 to 37.5, a drop of 10.1%. NH Investment Securities and Shinhan Investment Securities both reported a 57.7% and 73% increase in operating profit, respectively, while their cybersecurity investments each grew by 24%.
The personal data market in the financial sector is classified as a typical 'lemon market,' characterized by information asymmetry, quality opacity, and adverse selection mechanisms. Without transparency regarding budgets, personnel, organizational management, and responses to data breaches, customers cannot effectively choose financial firms that are proactive in security investments.
An anonymous source from a securities firm stated, "Cybersecurity investments do not attract attention until incidents like hacking occur, which discourages financial firms from establishing their own security centers or appointing dedicated Chief Information Security Officers (CISOs). Given that personal data in the financial sector often includes sensitive information like account numbers, there is a significant risk of misuse in voice phishing or secondary crimes. Therefore, various evaluation metrics, including the management of external contractors and improvements in security vulnerabilities, should be transparently disclosed."
According to financial authorities, there have been 40 hacking incidents involving 37 financial firms since the end of August, resulting in the leakage of approximately 473,000 personal data records. The government plans to review overall security management in the financial sector by the end of next month and determine the level of sanctions.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.