South Korea investigates 580 finance firms over data leaks, issues warning

South Korea is investigating over 580 finance firms following the leak of more than 470,000 data records from 37 companies in the past month, according to the Financial Services Commission (FSC). The FSC unveiled the extent of the breaches during a meeting with officials from trade associations and government agencies on Thursday, emphasizing the need to bolster cybersecurity measures in light of a series of similar incidents targeting the financial sector and government agencies.

The FSC disclosed that a total of 40 data leaks were reported at 37 companies, encompassing commercial banks, financial investment firms, insurance firms, and savings banks. Moreover, an estimated 1 billion won (US$745,000) in funds held by smaller brokers, insurers, and online financial businesses were stolen, though customer money remained unaffected.

Crucially, sensitive personal information, such as names, national identification numbers, bank account numbers, or passwords, was not included in the leaked data. The FSC plans to conduct thorough inspections of approximately 580 companies, including traditional financial institutions, electronic finance companies, and the virtual asset industry.

The inspection will scrutinize internal control operations, decision-making processes for managing external touchpoints, and the responsibilities of top management staff, including chief executives, chief information security officers, and chief information officers. FSC chairman Lee Eog-weon vowed that South Korea would not tolerate practices that cause incidents or exacerbate damage by disregarding known security risks, neglecting basic management duties, or relying on superficial inspections and complacent responses.

South Korea has experienced a series of data leaks, including the posting of passport details of 168 individuals, including President Lee Jae Myung and first lady Kim Hea-hyung, on a cybersecurity website in June, as well as a recent call by President Lee for the establishment of a central cybersecurity agency to coordinate responses across government bodies against cyberattacks.

Analysts suggest that President Lee's proposal for a new government-wide agency might not suffice if complacency persists among businesses and government agencies. Professor Park Dong-chul, an expert in security issues at Chung-Ang University, pointed out that many companies in South Korea still view cybersecurity as a costly nuisance until they experience a significant security breach, and they often resort to reactive, piecemeal measures to mitigate damage after an incident occurs.