Korea orders sectorwide checks after data leaks

South Korean financial regulators initiated an emergency response after a series of cyberattacks led to personal data breaches across the financial industry. The Financial Services Commission instructed financial institutions to promptly conduct internal security inspections and to report their findings to authorities. The aim is to establish the scope of the incidents and to strengthen defenses against further intrusions.

FSC Chairman Lee Eog-weon underscored the urgency of the situation, stating that the entire financial sector should carry out swift and thorough security inspections. Regulators emphasized that the measures apply across banks and non-bank financial firms, reflecting concern that the attacks have not been confined to a single segment of the market.

To coordinate the response, the Financial Services Commission moved up and convened a sectorwide review meeting on October 4. The meeting brought together heads of financial industry associations as well as chief executives of firms directly affected by the cyber incidents. Participants discussed immediate response steps, information-sharing mechanisms, and priorities for inspection and remediation.

Regulators signaled that the review will not be limited to incident management, but will also assess structural vulnerabilities exposed by the attacks. As part of this effort, they indicated that causes and methods of intrusion will be examined, with a view to identifying whether regulatory or supervisory measures need to be adjusted.

Among the confirmed cases, Shinhan Bank reported a data breach affecting about 25,000 customers. Yegaram Savings Bank reported that unauthorized access to a server on September 30 resulted in an estimated leak of about 40,000 customers’ personal data, including names, dates of birth and contact details, with the precise extent still under verification.

Other institutions reported more limited exposure. KB Kookmin Bank, Hana Bank and BNK Busan Bank each reported smaller data leaks, with reported counts in contemporaneous press of roughly 119, 89 and 11 customers respectively. Woori Bank and NH Nonghyup Bank reported attempted intrusions but no confirmed leaks of customer data.

Regulators, including the Financial Services Commission and the Financial Supervisory Service, dispatched investigators to the affected firms to support onsite checks and evidence gathering. Police launched a preliminary investigation into the cyberattacks impacting major banks, adding a law-enforcement dimension to the regulatory response.

Authorities have been sharing technical details of the intrusions, such as IP addresses and attack methods, with relevant agencies and financial institutions. This information-sharing is intended to help prevent follow-on attacks, support forensic analysis and inform both immediate fixes and longer-term improvements in security standards.

The wave of incidents has highlighted the exposure of customer data across both large commercial banks and smaller savings banks. The regulators’ call for comprehensive inspections suggests a recognition that cyber risks can propagate quickly across interconnected systems and institutions.

As internal inspections proceed and investigations advance, financial institutions are expected to reassess their security controls and monitoring practices. Outcomes from the emergency review and ongoing probes may shape future supervisory expectations and could influence how firms allocate resources to cybersecurity and data protection.