(EDITORIAL from The Korea Herald on Oct. 7)

Artificial intelligence has made cyberattacks even more insidious, rendering traditional security measures insufficient. In South Korea, financial institutions have recently fallen victim to a series of data breaches, highlighting the urgent need for a complete overhaul of the country's cybersecurity defenses. Seven major banks, including Shinhan Bank, KB Kookmin Bank, and Hana Bank, have reported personal data leaks, while others managed to thwart similar intrusions.

The attacks primarily targeted systems connected to the outside world, rather than the core networks responsible for handling deposits and transfers. This distinction is crucial, as it reveals a significant gap in the current level of protection.

The exposed systems often included services used by loan agents or employees, which may seem peripheral to internet banking but provide easy access to valuable personal information. For instance, Shinhan Bank alone disclosed the exposure of data belonging to approximately 25,000 customers, including their names, phone numbers, and annual income.

Hana Bank reported an individual leak affecting 89 customers. Authorities have initiated an investigation into the attacks, and financial regulators are scrutinizing whether artificial intelligence was involved. The use of AI has fundamentally altered the nature of cyber threats, as attackers no longer need to examine every potential target.

AI agents can identify exposed systems, probe weaknesses, and rapidly adapt attacks, rendering conventional reconnaissance methods ineffective.

The financial authorities identified 19 IP addresses across 12 countries associated with the recent attacks, though the ultimate perpetrators remain under investigation. The global spread of these attacks underscores the challenges faced by financial regulators, as defense strategies relying on known threats become inadequate in the face of rapidly changing tactics.

Traditional security definitions, such as certificates attesting to compliance with prescribed procedures, are no longer sufficient. A single vulnerability in an obscure external-facing application can be exploited, even when an institution appears secure overall. This highlights the need for a more comprehensive approach to cybersecurity.

A comparison between affected and successfully defended institutions sheds light on the importance of adopting a more robust security posture. Woori Bank and NH Nonghyup Bank, for example, faced similar cyberattacks but managed to prevent unauthorized access. Their defenses reportedly incorporated biometric verification, restricted IP access, and tighter network separation.

These measures should serve as a blueprint for regulators, prompting a reevaluation of what constitutes adequate security. While security spending remains crucial, it is not a reliable indicator of an institution's ability to detect and contain intrusions in real-time. Instead, regulators should shift towards regular, unannounced exercises that test every externally accessible system, including those operated by partners and contractors.

Merely passing an inspection does not guarantee security, as it often reflects little more than compliance with prescribed procedures.

Collaboration is essential to effectively combat cyber threats. Financial institutions that discover new attack routes possess valuable information that could protect their competitors. However, concerns about liability or reputational damage often discourage disclosure. Regulators should establish safeguards for prompt reporting and mandate the rapid sharing of both successful breaches and attacks that were thwarted.

The value of a blocked intrusion is comparable to a successful one, as it provides insights into how an attack functions and where other institutions may be vulnerable. Furthermore, the urgency of this issue extends beyond the financial sector. A separate leak at Korea Electric Power Corp. exposed sensitive information belonging to about 24,000 employees, although the company claimed it was unrelated to the recent AI-linked financial attacks.

It is clear that critical institutions have expanded their systems as their core networks became more resilient to traditional attacks, turning peripheral layers into potential weak points.

To address this multifaceted challenge, South Korea should treat financial cybersecurity as a national infrastructure protection issue. The objective should no longer be to construct an impenetrable wall around the vault, but to ensure that all service entrances, side doors, and administrative portals receive the same level of scrutiny as the core systems.

In the era of AI-assisted cyberattacks, security must be measured not by the certificate hanging on the wall, but by the institution's response when someone attempts to breach the door.