A year after a pledged 'sector-wide review,' 16 Korean financial firms breached and 100,000 records leaked; regulators repeat the same remedies

SEOUL

About a year after South Korea's financial regulators promised a "comprehensive financial security and information protection review of the entire financial sector" following the Lotte Card data leak, 16 financial companies including four banks have been hacked and about 100,000 records of personal information have been leaked. The Financial Services Commission (FSC) held its "2nd Emergency Situation Response Meeting" at 3 p.m. on the 14th at the Government Complex Seoul, chaired by Secretary General Shin Jin-chang, where it disclosed the scale of the damage and said that in self-inspections of all 555 companies in the financial sector, 130 had reported shortcomings such as failing to apply the latest security patches and failing to establish 24-hour monitoring. The FSC again put forward full inspections and stronger chief executive officer (CEO) accountability as remedies that day, but said the scope and schedule of inspections would be set "in consultation with the financial sector." A year ago, at the time of the Lotte Card incident, the FSC said it would manage and supervise "Lotte Card's consumer protection measures, such as full compensation," but the word "compensation" does not appear in the materials on the measures released on the 14th.

Sixteen firms breached a year after a pledged 'sector-wide review'

On September 18, 2025, the FSC held an emergency countermeasures meeting on the Lotte Card data leak, chaired by Vice Chairman Kwon Dae-young. The FSC set out as its task "a comprehensive financial security and information protection review of the entire financial sector and fundamental institutional improvement," and said, "An emergency inspection of the financial sector's security management posture and fundamental institutional improvements related to IT security will also be launched immediately." Kwon asked financial companies to "comprehensively re-examine your entire IT systems and information protection systems under the responsibility of the CEO," and warned, "as a complacent attitude that regards security investment as a cost or extra work can lead to a serious situation." The FSC said it would "introduce punitive penalty surcharges that go beyond the level of ordinary penalty surcharges in the event of a major security incident."

A month later, on October 22, 2025, the Ministry of Science and ICT announced a "Pan-Government Comprehensive Information Protection Plan" together with related ministries. Bae Kyung-hoon, deputy prime minister and minister of science and ICT, gave the briefing, and FSC Secretary General Shin Jin-chang also appeared. The government said it would "immediately push for a large-scale security vulnerability inspection of some 1,600 IT systems used by the majority of the public, including in the public, financial and telecommunications sectors." "Strengthening CEO responsibility and the role of the CISO" and "introducing punitive penalty surcharges" were also included in the plan.

Less than a year later, on September 30, 2026, financial authorities received a report of a breach at Shinhan Bank. FSC materials on October 2 stated that "additional damage has occurred from cyberattacks on major financial companies including Kookmin Bank." The affected companies disclosed by the FSC on the 14th are four banks (Shinhan, Kookmin, Busan and Hana), four savings banks (Yegaram, Welcome, DB and OK), two specialized credit finance companies (Hyundai Capital and KDB Capital), two online investment-linked finance companies (PFCT and Mouda), one electronic financial business operator (Brightfix), two virtual asset service providers (Streami and Prabang) and one mutual finance institution (Korean Federation of Community Credit Cooperatives). That is 16 companies across seven sectors. The FSC said, "the scale of the data leak has been identified at around 100,000 records (names, contact information, resident registration numbers, email addresses, etc.)," and said the number of affected companies could rise further during the investigation.

In the two weeks after the Shinhan Bank report, the number of affected companies in the authorities' materials kept growing. The October 2 materials named Shinhan Bank and Kookmin Bank, and materials for the meeting chaired by the FSC chairman on the 4th listed, without names, seven major financial companies that had reported breaches. In the materials on the 14th, the number became 16.

130 financial firms lacked basics such as security patches and 24-hour monitoring

The first inspection authorities launched after the latest breaches was not an on-site examination by the Financial Supervisory Service (FSS) but a self-inspection by financial companies. Authorities distributed a 12-item checklist following the October 2 meeting, and 555 companies submitted results by October 8. The FSC said, "As a result of the inspection, a total of 425 companies submitted 'adequate,' and 130 companies reported having shortcomings." That is 23.4% of the companies inspected.

The shortcomings were "failure to apply the latest security patches," "inadequate management of systems past manufacturer end of technical support (EOS: End of Support)," "failure to establish real-time (24-hour) monitoring systems" and "inadequate attack surface management." As examples of inadequate attack surface management, the FSC cited "missing authentication and authorization for external-facing systems, and failure to introduce enhanced authentication procedures (MFA) for critical services." The FSC said, "Relatively many shortcomings were found in the electronic financial business and online investment-linked finance sectors, which have relatively weak security capabilities."

Security patches were an issue the FSC itself had flagged five months earlier. On May 22, 2026, the FSC held a "Meeting on Responding to Security Threats in the Financial Sector Related to High-Performance AI" and said it would prepare AI security guidelines in June. It said the guidelines would contain "practical standards such as criteria for classifying IT resources and priorities for program patches." Small and medium-sized financial companies and others asked at the time, "let us know the priorities so that we can apply the most urgent security patches first." Five months later, "failure to apply the latest security patches" topped the list of main shortcomings in the self-inspection.

FSC says it 'ordered repeatedly,' pointing to financial firms' failure to observe basics

Financial authorities said they had responded from immediately after the incident. According to the FSC, the FSS and the Financial Security Institute began an on-site investigation on September 30, the day they received the report of the Shinhan Bank incident, and are still investigating the intrusion routes and attack methods. Authorities shared the attackers' IP addresses with the entire financial sector and held a series of meetings: meetings chaired by the secretary general on October 2 and 14, and the FSC-FSS joint "All-Financial-Sector Emergency Inspection Meeting" chaired by FSC Chairman Lee Eog-weon on the 4th. The Ministry of Science and ICT, the Ministry of the Interior and Safety, the Personal Information Protection Commission, the Korean National Police Agency and the Korea Internet & Security Agency (KISA) also attended the meeting on the 14th.

Secretary General Shin pointed out on the 14th, "Despite having ordered comprehensive inspections and strengthened management on numerous occasions, prompted by various incidents such as the Lotte Card data leak and the Mythos shock, it is very painful that cases have been found where financial companies are not properly observing the basics." Shin said, "As trust and safety matter more than anything else in the financial sector, thorough security management to prevent security incidents is essential." Chairman Lee said on the 4th, "Taking this situation as an occasion, the entire financial sector must, with extraordinary resolve and the highest level of vigilance, re-examine its overall information security system from scratch and raise its security level by a notch."

The FSC identified as the attack route the systems used by "external personnel such as loan solicitors and contractors, which were the cause of recent breaches." The FSC instructed that "in principle, all external access is to be blocked, except where indispensable for providing consumer services or performing business," and said that if "similar breaches occur" despite attack information having been shared, "we plan to respond sternly in accordance with relevant laws."

By Secretary General Shin's account, the authorities repeatedly ordered full inspections at the time of the Lotte Card incident and the Mythos shock. Even so, in the October 2026 self-inspection, 130 of 555 companies reported on their own that they lacked basic items such as patches and monitoring. The method of inspection also changed. In September 2025, the FSC said it would "immediately begin an FSS inspection of the security status of all card companies," but the first sector-wide inspection after the October 2026 breaches was a self-inspection in which financial companies filled out a checklist.

Measures of a year ago and of the 14th overlap on 'CEO responsibility, full inspection, institutional improvement'

The four sets of measures the FSC announced on the 14th largely overlap with the wording of a year ago. The first item is a comprehensive security inspection. Financial companies must "list and update all points of contact where computer systems connect to the outside," and authorities said they would guide and supervise companies "to also clarify the reporting systems and scope of responsibility of the CEO, CISO, CIO, etc." What the FSC demanded in September 2025 was a "comprehensive re-examination" of the entire information protection system "under the responsibility of the CEO," and the pan-government plan in October of that year included "strengthening CEO responsibility and the role of the CISO."

Tougher sanctions were repeated as well. The FSC said on the 14th that it "plans to promptly pursue various institutional improvement measures to strengthen CEO responsibility and enhance the effectiveness of sanctions." In September 2025 it had promised "punitive penalty surcharges," and the pan-government plan in October promised "raising fines and penalty surcharges, and introducing enforcement fines and punitive penalty surcharges." A year on, the same matter has come back as something it "plans to pursue." Under the new penalty surcharge criteria approved by the FSC on the 21st, the statutory cap under the Credit Information Act is still stated as, in principle, 3% of total revenue.

The October 2025 pan-government plan said it would "immediately push for" a security vulnerability inspection of "some 1,600 IT systems," including in finance. A year later, on October 14, 2026, the FSC again brought up full inspections and said it would "swiftly finalize" "the specific scope and schedule of inspections" in consultation with the financial sector.

New measures left without deadlines, as 'promptly' and 'review'

The only dated item in the press release of the 14th is the deadline (October 8) for the checklist inspection that has already been completed. Everything still to be done has no deadline.

In early threat detection, the AI threat level information system is something "we plan to put in place promptly," and on AI-based vulnerability inspection infrastructure the FSC said it "will also pursue its construction." In ongoing supervision, it will push to "expand to twice a year or more," for large firms only, the vulnerability inspections and assessments that financial companies currently conduct once a year (twice a year for external websites), and a legal basis for ad hoc inspections by authorities is something it "plans to review and pursue." In support for small and medium-sized firms, the Financial Security Institute will "review" building an AI-based joint security monitoring system with sector associations and central federations. For money lenders and insurance general agencies (GAs), which are not subject to the Electronic Financial Transactions Act, the FSC said it would "promptly review and pursue" ways to strengthen security.

At the first meeting on October 2, too, the FSC said only that it "plans to have them submit and report" self-inspection results "at the earliest possible date." The inspection was completed on the 8th, and by the 14th the number of confirmed affected companies had grown to 16.

Network separation easing and patch-outage leniency in May, lower surcharges for minor violations on the 21st

Alongside its response to the hacking, the authorities have continued to take measures that loosen regulation. At the May 22 meeting, the FSC said it would "swiftly push to ease network separation regulations for the use of AI for security purposes," and decided that 49 financial companies with total assets of 10 trillion won or more and 1,000 or more regular employees would, on application, have the rules temporarily lifted for one year. For financial companies with advanced capabilities, it said it "plans to review and pursue a plan to fully lift network separation regulations." For minor IT outages arising in the course of security patching, it said it would "also pursue reduced sanctions and exemption, on the premise of prompt recovery and consumer protection measures." Vice Chairman Kwon Dae-young said at the time, "High-performance AI security threats are like a cold virus: they are not something that can be completely blocked, but a threat that must be managed while living with it." Secretary General Shin said again on the 14th, "We will also pursue institutional improvements, such as easing network separation regulations, more carefully and with greater speed."

The amendment to the "Regulations on Supervision of Credit Information Business" approved at the 18th regular meeting on the 21st takes effect on the 23rd. The base penalty rates, previously in three levels of 50%, 75% and 100%, were changed to continuous ranges: 1-30% for weak violations, 30-65% for serious violations and 65-100% for very serious violations. The example cited by the FSC is a hypothetical financial company with revenue of 7 trillion won and net income of 700 billion won. For a "violation of weak gravity" with a gravity score of 1.2 points, the base penalty falls to one-fifth, from 105 billion won (base rate 50%) previously to 21 billion won (base rate 10%). For a case with a gravity score of 2.5 points, 157.5 billion won is calculated at a 75% base rate under the new criteria, and a 25% aggravation of 52.5 billion won is added, for 210 billion won, the same as before.

The FSC explained that repeating the same violation within three years or large-scale leaks affecting 10 million or more people can be aggravated by up to 100% of the base penalty. Voluntary strengthening of personal credit information protection and prompt implementation of consumer protection measures were expanded as grounds for reduction. The latest leak of 16 companies and about 100,000 records falls far short of the 10-million-person aggravation threshold. Transitional measures follow Article 14 of the Framework Act on Public Administration: the regulations in effect at the time of the violation apply to violations committed before the amendment, but the amended regulations may be applied if they are more favorable. The FSC explained that it had raised predictability by transparently disclosing the penalty surcharge criteria.

Compensation wording retreats from 'supervising full compensation' to 'need to do its best'

At the time of the Lotte Card incident in September 2025, FSC materials listed "full advance compensation in the event of fraudulent use due to the breach" as a Lotte Card measure, and the FSC said it would "closely manage and supervise" "Lotte Card's consumer protection measures, such as full compensation in the event of related damage." The pan-government plan in October of that year said it would "ease consumers' burden of proof if hacking occurs due to a company's security negligence" and would "review establishing a fund" that would use penalty surcharge revenue to support victims.

In the current breaches, the compensation wording has weakened by a step. The materials for the October 4 meeting stated that financial companies where breaches occurred "need to do their best, where consumer damage is confirmed, to notify consumers of detailed information and ensure that damage relief and compensation are carried out promptly and without disruption." The materials on the measures of the 14th, which disclosed damage at 16 companies and about 100,000 records, do not once contain the words "compensation" or "damage relief."

The authorities put the emphasis on blocking secondary damage. On the 6th they issued Consumer Alert No. 2026-26 at the "caution" level and designated the month from the 6th as a "special response period for secondary damage from personal information leaks." They instructed financial companies to set up dedicated counseling desks and to strengthen fraud detection systems (FDS). The authorities said, "To date, no cases have been confirmed in which customer funds were drained through voice phishing or other damage related to the recent personal information leak incidents at financial companies." According to the authorities, the leaked information includes resident registration numbers, but passwords and one-time passwords (OTP) were not leaked.

The prevention tools the authorities pointed to are mostly services that consumers must apply for themselves. About 7 million people (duplicate subscriptions possible) had signed up for the "safe block" services for credit transactions, non-face-to-face account opening and open banking as of the end of August, and the accident prevention system for persons whose personal information has been exposed on the FSS's FINE portal (fine.fss.or.kr) also requires individuals to register. The authorities said ASAP, the financial sector's platform for sharing information on suspected fraud, suspended payments from 7,666 suspicious accounts from its launch in October 2025 through August 2026, preventing about 69.94 billion won in damage.

Sources (KST)

• Financial Services Commission · 2026-10-14 · 금융권 침해사고 재발방지를 위해 금융보안 관리체계를 전면 강화하겠습니다. 금융위 사무처장 주재, 「제2차 긴급 상황대응 회의」 개최 · https://www.fsc.go.kr/no010101/87927
• Financial Services Commission · 2026-10-06 · 全금융권이 비상한 경각심을 갖고 침해위협에 대응해 나가겠습니다. - 금융위원장 주재 금융위·금감원 합동 「全금융권 긴급 점검회의」 개최 · https://www.fsc.go.kr/no010101/87876
• Financial Services Commission · 2026-10-06 · 최근 금융권 개인정보 유출사고에 따른 보이스피싱·스미싱 등 피해에 주의하세요. · https://www.fsc.go.kr/no010101/87882
• Financial Services Commission · 2026-10-02 · 최근 발생하는 금융권 침해위협에 면밀히 대응해 나가겠습니다. - 금융위원회 사무처장 주재 「긴급 상황대응 회의」 개최 · https://www.fsc.go.kr/no010101/87869
• Financial Services Commission · 2026-10-21 · 신용정보법 과징금 부과의 예측 가능성을 한층 높였습니다. - ｢신용정보업감독규정｣ 개정안 제18차 정례 금융위원회 의결 · https://www.fsc.go.kr/no010101/87973
• Financial Services Commission · 2026-05-26 · 금융권 AI 전환 본격화! 금융분야 망분리 규제를 완화하여 혁신은 넓게, 보안은 더 단단하게 하겠습니다. - ｢고성능 AI 관련 금융권 보안위협 대응 간담회｣ 실시 · https://www.fsc.go.kr/no010101/86972
• Korea Policy Briefing (Ministry of Science and ICT and related ministries) · 2025-10-22 · 범부처 정보보호 대책 발표…해킹 정황 시 기업 신고 없어도 조사 · https://www.korea.kr/news/policyNewsView.do?newsId=148952831
• Financial Services Commission · 2025-09-18 · 롯데카드 정보유출 관련 긴급 대책회의 개최 · https://www.fsc.go.kr/no010101/85319