The number of financial companies that have suffered customer information leakage due to artificial intelligence (AI) hacking has reached a total of 16 so far, with an estimated 100,000 records of information leaked, according to investigations.

The Financial Services Commission (FSC) held its 2nd emergency response meeting at the Seoul Government Complex on the 14th to inspect the current status of financial security incidents.

Immediately following the hacking incidents at Shinhan Bank and other financial institutions, the FSC, along with the Financial Supervisory Service (FSS) and the Financial Security Institute (FSI), dispatched on-site inspection teams and took measures such as sharing attacker IP addresses and distributing checklists.

According to financial authorities, a total of 16 financial companies across all sectors—including banks, savings banks, cooperative finance, specialized credit finance, electronic financial business, online-to-offline investment (P2P) platforms, and virtual asset service providers—have been confirmed to have experienced incidents around the time of the Shinhan Bank security breach.

As financial companies are still verifying whether breaches have occurred based on the shared IP addresses and other data, the number of affected financial companies is likely to increase further.

Additionally, the number of confirmed information leakage cases has reached 100,000, consisting of names and contact information.

An FSC official stated, "The leakage of information such as account numbers and card numbers, which pose a direct risk of fraudulent transactions, has not been confirmed."

For financial companies that reported incidents, the FSC blocked the attacker IP addresses and ordered additional measures to prevent further security breaches, such as applying security patches and suspending related services.

It is also managing and supervising consumer protection measures, including notifying users of personal information leakage and providing response guidelines.

Furthermore, based on on-site investigations by the FSS and the FSI, authorities are identifying intrusion pathways and attack methods to determine whether there are links between the security incidents or if they were committed by the same perpetrator.

130 Out of 555 Financial Companies Self-Discovered "Deficiencies"… Security Management to Be Expanded from Once to Twice a Year

Following the hacking incidents, the FSC conducted a checklist inspection across 555 financial institutions nationwide regarding 12 items until the 8th. The results showed that 425 companies submitted "appropriate" ratings, while 130 companies reported having deficiencies.

The FSC stated, "Most of the deficiencies were identified in 1 to 2 checklist items related to security patches and monitoring systems," adding, "Many deficiencies were found in the electronic financial business and online-to-offline investment sectors, which have relatively weaker security capabilities."

Specifically, the reported issues included: $triangle$ failure to apply the latest security patches, $triangle$ poor management of systems whose manufacturer technical support has ended (EOS: End of Support), $triangle$ failure to establish a real-time (24-hour) monitoring system, and $triangle$ poor attack surface management (omission of authentication and authorization for external systems, failure to introduce multi-factor authentication (MFA) for critical services, etc.).

Consequently, during the meeting, authorities discussed institutional improvement tasks to structurally prevent the occurrence of vulnerabilities discovered during the inspections.

To this end, the financial sector plans to inspect overall security management, including internal controls, and formulate response plans so that it can sufficiently prepare against AI hacking threats.

The authorities plan to catalog and update all connection points where computer systems interface with the outside world, and clearly set and strictly manage authorization and access control for these external contact points. They also intend to guide and supervise the clear definition of responsibilities and reporting lines for CEOs, CISOs, and CIOs in operating and managing security systems, including external contact point management.

In addition, the system will be improved so that when hacking threats occur, financial companies can rapidly disseminate such information across the entire financial sector and share threat data gathered on their own through integrated monitoring systems and other platforms.

The establishment of an AI-based vulnerability inspection infrastructure will also be pursued to detect vulnerabilities in externally exposed assets, internal source code, and mobile applications from an attacker's perspective.

Along with these measures, security management, which is currently mandated once a year, will be expanded to twice a year or more, and critical external contact points will be included as mandatory inspection targets. The authorities also plan to establish grounds for conducting ad-hoc inspections during urgent situations.

Shin Jin-chang, Secretary General of the FSC, stated, "It is very painful that despite ordering full-scale inspections and enhanced management on several occasions through various catalysts such as the Lotte Card information leakage and the Mythos Shock, basic parts were still not properly observed by financial companies." He added, "We will more closely and swiftly pursue institutional improvements, such as easing network separation regulations, to establish a security system where 'AI attacks are defended by AI.'"

[Copyright (c) Global Economic Times. All Rights Reserved.]