South Korea plans cybersecurity overhaul after attacks hit banks, crypto firms

What happened

South Korea's Financial Services Commission is proposing tighter cybersecurity requirements for financial institutions. The plan follows an investigation into earlier security incidents at 16 companies, including crypto exchanges. The FSC named crypto businesses Streami and Pravang among the 16 firms hit by recent data breaches, alongside Shinhan, Kookmin, Busan and Hana banks.

An industry-wide review found cybersecurity deficiencies at 130 of 555 financial companies. The FSC said about 100,000 pieces of customer information had been exposed across the affected firms, including names, contact details and identification numbers.

Streami operates the Gopax exchange, and Pravang is the other crypto business named in the release. The FSC also estimated about 100,000 pieces of customer data were exposed across the affected companies, including names, contact details, resident registration numbers and email addresses. It did not publish a company-level breakdown.

Cointelegraph reported that Streami and the crypto trading platform Prabang previously disclosed that an Oct. 2 hack exposed personal information of some customers. Under the proposed reforms, larger financial institutions would undergo vulnerability assessments at least twice every year, up from the existing annual testing requirement. The regulator also plans improved threat monitoring and stronger accountability for executives.

Why it matters

The proposals reach beyond how often firms test their defenses. The FSC plans a comprehensive review of external connections, authentication and access controls, with clearer reporting lines and responsibilities for chief executives, chief information security officers and chief information officers.

The review found shortcomings mainly in security patches and monitoring systems. Regulators also plan faster sharing of threat information detected by companies and are considering AI-based defenses, including acceleration of consideration of easing rules on separating computer networks.

As of the October 14 meeting, authorities had not identified leaked account passwords or credit card numbers. The Financial Supervisory Service and Financial Security Institute are investigating the attack methods, whether the incidents are linked, whether a common attacker was responsible and whether AI was used.

What the data shows

All 555 companies completed a 12-point checklist by October 8. Of those, 425 reported their arrangements were appropriate and 130 reported areas needing improvement.

Existing rules require annual testing for financial companies and electronic financial businesses, while external websites already have to be checked twice yearly. One proposal would require vulnerability assessments at least twice a year, starting with large financial companies.

Separately, the Financial Intelligence Unit disclosed on October 13 blocking decisions for 27 unregistered crypto websites, including KuCoin and MEXC.

What is still unclear

• The release did not specify whether each proposed financial-company measure would cover virtual asset businesses.
• The inspection's detailed scope and schedule had yet to be agreed.
• The FSC said it is still investigating whether the incidents involved AI use or were linked to the same attackers.
• More firms could be added as companies check their systems against attacker IP addresses shared by authorities.
• The two source reports spell the second crypto firm's name differently, as Prabang and Pravang.

Questions readers ask