After confirming that security incidents occurred at 16 institutions, resulting in the leakage of approximately 100,000 customer records, and that vulnerabilities were found in 130 out of 555 institutions under investigation, South Korea has proposed to implement stricter cybersecurity regulations for banks, cryptocurrency companies, and other financial institutions.

The Financial Services Commission of Korea ( FSC ) announced these proposals after holding its second emergency meeting in Seoul. The meeting reviewed recent attack incidents and the results of industry-wide security inspections. The proposed changes include more frequent vulnerability assessments, enhanced threat monitoring, and clearer definition of responsibilities for company executives.

Security issues found in 130 companies in South Korea

As reported by FSC, as of October 8th, a checklist comprising 12 items for network security inspections was used to review 555 financial companies. Among them, 425 companies indicated that their security measures met the requirements of the checklist, while another 130 companies were identified to have issues that required rectification.

Regulatory authorities stated that most of the affected companies only need to make improvements in one or two areas. Common issues include outdated security software, weak monitoring systems, and insufficient protection for computer systems that are accessible from outside.

Some companies have not yet installed the latest security updates. Others are still running operating systems that are no longer supported by the manufacturers, and as a result, they cannot receive regular security maintenance.

Inspections also revealed that some companies lack continuous security monitoring. Relevant departments have identified vulnerabilities in access control, including the failure to use multi-factor authentication and other enhanced authentication procedures for certain critical systems.

Electronic financial service providers and online lending companies report relatively more issues. FSC indicates that this is partly due to the limited resources available to these industries for network security.

The company that discovered the vulnerability has submitted a rectification plan, which includes installing security updates, replacing outdated equipment, expanding the staffing for monitoring, and restricting access to sensitive systems.

Regulatory authorities stated that the affected companies have begun to implement corrective measures after review.

It should be noted that not all of these 130 companies with security vulnerabilities are victims of hackers. FSC has separately confirmed that security incidents did indeed occur at 16 financial institutions.

16 affected institutions include cryptocurrency companies

The incidents confirmed by the investigation involve four commercial banks, four savings banks, lending companies, electronic financial service providers, online investment businesses, and two cryptocurrency service operators.

The digital asset companies affected include Streami, which operates the Gopax cryptocurrency exchange, as well as Prabang, which was identified as a virtual asset service provider in the announcement from FSC.

The affected banking institutions include Shinhan Bank, KB National Bank, Busan Bank, and Hana Bank. The savings banks include Yegaram, Welcome, DB, and OK.

Other affected companies include Hyundai Capital, KDB Capital, PFCT, Mouda, as well as the Korea Community Credit Cooperatives Federation.

FSC It is estimated that approximately 100,000 pieces of customer information were leaked among these confirmed incidents.

The compromised records include names, phone numbers, email addresses, and South Korean resident registration numbers.

However, the committee stated that investigators have not yet confirmed the leakage of account passwords or payment card numbers, which could potentially be used directly for unauthorized transactions.

After the incident, regulatory authorities required affected companies to block IP addresses related to suspicious activities, apply security patches to applications, and suspend services with vulnerabilities if necessary.

Customers whose information has been leaked will receive notifications as well as guidance on protective measures.

The Financial Supervisory Service and the Financial Security Research Institute are still investigating how the attackers managed to gain access to the affected systems. Investigators are comparing technical evidence from each incident to determine whether they were carried out by the same group of individuals or entities.

Authorities have not yet confirmed whether artificial intelligence played a role in these attacks.

South Korean cryptocurrency companies have previously faced separate security investigations as well. In July of this year, the Financial Supervisory Service initiated sanctions procedures regarding a previous wallet leakage incident involving Dunamu, the operator of Upbit.

In regards to the regulatory investigation into the hacker attack on Upbit in November 2025, it involves the security responsibilities of the exchange as well as its compliance with current virtual asset protection laws.

This program is aimed at another incident; FSC indicates that it has not been linked to the latest round of attacks on the financial sector.

South Korea proposes to conduct cybersecurity inspections twice a year

After the release of the inspection results, FSC proposed a plan to increase the frequency of network security assessments, starting with large financial institutions.

Currently, financial regulatory rules typically require a vulnerability assessment to be conducted once a year, while inspections of external websites are already carried out twice a year.

The proposed reform will increase the assessment frequency to at least twice a year, and it will apply to large institutions with extensive external links and a large customer base.

Regulatory authorities plan to designate important external access points as mandatory inspection targets. Relevant departments are also considering adding additional security checks outside of the planned review process in the event of urgent threats.

The committee also plans to conduct a more detailed review of financial institution systems, covering external connections, authentication procedures, and internal controls.

Under the proposed arrangements, the company needs to keep more detailed records of how external systems connect to its network, as well as which employees or services have access to sensitive information.

FSC hopes to more clearly delineate the responsibilities of the Chief Executive Officer, the Chief Information Security Officer, and the Chief Information Officer.

Regulatory authorities are studying how to strengthen accountability when companies fail to implement necessary security measures or ignore recommendations from inspections.

The committee has not announced the final implementation date for the requirement of conducting evaluations twice a year.

The details of the schedule and the institutions applicable will be determined after further consultation with representatives from the financial industry.

Financial regulatory agencies plan to launch new AI security tools

In addition to mandatory inspections, FSC also plans to improve the way financial institutions report suspicious cyberattacks.

Currently, the Financial Supervisory Service and the Financial Security Research Institute distribute threat information to companies through a comprehensive monitoring platform named FIRST.

However, the information identified by individual financial institutions through their own monitoring systems is not consistently shared across the entire industry.

Regulators hope to expand the system so that companies can report newly discovered threats and help other enterprises respond before similar attacks spread.

Authorities are preparing to establish a threat monitoring framework based on AI, which will be used to classify the severity of identified risks and provide information to financial institutions.

FSC is still considering using the AI tool for vulnerability testing on externally exposed computer systems, internal software code, and mobile applications.

Smaller companies can obtain support by collaborating with financial industry associations to develop shared AI monitoring services.

The Financial Security Research Institute will evaluate this proposed service and develop corresponding security guidelines for enterprises with limited technical resources.

At the meeting on October 14th, Secretary-General FSC Shen Zhenchang criticized some financial companies for still not complying with basic network security requirements despite multiple warnings.

He said that it is "very painful" to discover these defects again after previous financial security incidents have already prompted the outside world to call for strengthened controls.

Shen Zhenchang calls for improvements in external connections, authentication procedures, monitoring systems, and executive responsibilities.

He said that regulatory authorities will promote the establishment of a system aimed at "using AI to defend against AI attacks."

Authorities had previously issued fraud warnings to customers.

Before announcing the latest proposal, South Korean regulatory authorities had issued a consumer warning regarding the potential misuse of information leaked from the financial industry.

On October 6th, FSC and the Financial Supervisory Agency issued a level-one warning notice to remind customers to be vigilant against phishing attacks and fraudulent loan applications.

Two institutions have established a special response period lasting one month, starting from October 6th.

During this period, financial companies were required to provide assistance to affected customers and to strengthen monitoring of suspicious account openings, loan applications, and large-value transfers.

Authorities have instructed companies to use the anti-phishing sharing and analysis platform ASAP based on AI to distribute information regarding suspected fraud.

Regulatory authorities state that if suspicious activities involve potentially stolen customer information, companies should require further identity verification.

At the time of the notification on October 6th, authorities had not yet confirmed whether the recently leaked information was used for phishing or unauthorized transfers that resulted in financial losses.

Two institutions stated that if financial losses involving the stolen information are subsequently confirmed, they will raise the consumer warning level from level one to level two.