South Korean president orders probe into data leaks across financial industry

South Korean President Lee Jae Myung has ordered an extensive probe into recent data breaches at banks, finance companies, and public agencies, according to Seoul's presidential office. Financial Services Commission (FSC) Chairman Lee Eog-weon convened an emergency meeting on Sunday with industry associations, regulators, and executives from impacted institutions, emphasizing the need for top-tier vigilance in response to the breaches.

Lee suggested the possibility of AI being used in the attacks and proposed an "AI attacks defended by AI" strategy, alongside calls for substantial upgrades to the financial sector's cybersecurity framework.

Earlier meetings on Friday revealed that Shinhan Bank, KB Kookmin Bank, and other institutions had reported cyberattacks, while Yonhap news agency confirmed breaches at Hana Bank and Woori Bank. The financial regulator has initiated on-site investigations following Shinhan Bank's breach on September 30, subsequently expanding the probes to other incidents.

Authorities have mandated comprehensive security inspections, tighter access controls, reduced external system access, and enhanced consumer protection measures. The regulator also pledged to share attack methods, internet protocol addresses, and other threat intelligence across the industry to prevent future incidents.

Yonhap news agency reported that regulators suspect the attacks may have scanned multiple financial companies for vulnerabilities rather than targeting a single institution. The suspected attack traffic originated from IP addresses in various countries, including the United States, Japan, Singapore, Vietnam, and Britain, as per bank data submitted to lawmakers.

The emergency meeting was convened one day earlier than initially planned after additional breaches at second-tier financial institutions were discovered, according to multiple Korean media reports. The main opposition People Power Party suggested that authorities should also investigate the potential involvement of North Korea, citing past cyberattacks attributed to Pyongyang against South Korean financial institutions.