An AI-generated graphic depicts hacking attacks spreading across the financial sector, which have hit a brokerage, an asset manager, an insurer and a cryptocurrency exchange in recent weeks.CHATGPT
Hacking attacks in Korea’s financial sector have spread from banks to a brokerage, an asset manager, an insurer and a cryptocurrency exchange.
Financial companies Daishin Securities, Mirae Asset Global Investments and the crypto exchange Bithumb reported breaches on Wednesday, just two weeks after regulators released the results of an emergency security check in which most financial firms rated their own defenses adequate.
The timing has put self-inspection to the test, especially as breaches at commercial and savings banks that came to light in late September are suspected to have been carried out using AI agents.
The personal and credit information of 38,490 Daishin customers was leaked in a hacking attack, the securities firm said. The figure is the second-largest disclosed in the recent wave, after the 43,246 customers affected at Yegaram Savings Bank, and exceeds the 25,729 at Shinhan Bank and the 2,210 at KB Kookmin Bank.
The attack hit a system Daishin shares with an external partner. The securities firm detected signs of abnormal access to a server linked to its online account-opening service for discretionary investment accounts on Oct. 17. It immediately blocked the attacking IP addresses and the addresses used to reroute the connections, and reported the incident to the authorities.
Working with the Financial Security Institute, Daishin then combed through more than 60,000 signals disguised as normal service traffic over 10 days and confirmed the leak on Monday. The leaked data covers eight items: customers’ names, email addresses, postal addresses, communication IDs and bank names, as well as their encrypted deposit and withdrawal account numbers, Daishin integrated account numbers and mobile phone numbers.
The firm will notify affected customers individually and compensate any losses in line with the law and its own procedures, Daishin said.
Mirae Asset's logo is shown at the Mirae Asset Center 1 building in central SeoulMIRAE ASSET SECURITIES
Mirae is investigating an attack in which it believes the intruder created an account and downloaded data from some of its systems that serve employees without authorization.
“The system in question does not serve individual clients, so general customer [investor] information is not involved,” an official at the asset manager said. “If there was a leak, it could involve things like employees’ names, email addresses and files.”
Mirae Asset Life Insurance, an affiliate, had reported a breach of its customer application system and part of its website to the authorities Sunday.
Bithumb, Korea’s No. 2 cryptocurrency exchange, found traces of unauthorized access to its internal mobile groupware for employees Tuesday and reported it Wednesday.
The logo of virtual asset provider Bithumb is seen in southern Seoul on March 16.NEWS1
“What was breached is a system that supports employees’ work, not the core computing facilities that handle cryptocurrency trading,” a Bithumb spokesperson said. “No leak has been confirmed so far of information that could be used for fraudulent payments or asset transfers, such as cryptocurrency wallet addresses.”
Other companies using the same outsourced groupware could also be exposed if a vulnerability common to the software is to blame.
“Hackers appear to be trying to break into multiple companies,” a senior employee at a financial company said. “We are running constant security checks using white-hat hackers.”
The Financial Services Commission (FSC) held an emergency inspection meeting Wednesday, and the Financial Supervisory Service (FSS) began on-site inspections.
“Breaches at domestic financial companies are taking an all-out form, with cyberattack methods growing more sophisticated by the day and targets expanding to noncore facilities,” FSS Gov. Lee Chan-jin said at a meeting with board chairs of bank holding companies Wednesday. “With AI being used as a hacking tool, security vulnerabilities are easily found and simultaneous attacks look set to become constant. Financial companies must quickly build their own autonomous defense systems.”
The logo of Daishin Finance Group is seen at the firm's headquarters in Jung District, central Seoul on Oct. 28.NEWS1
The authorities plan to have businesses in cryptocurrency and other sectors not covered by the Electronic Financial Transactions Act adopt security measures and incident response systems on par with those of banks and other major financial companies.
The emergency check had 555 financial companies inspect themselves in 12 categories through Oct. 8, and the FSC released the results on Oct. 14. Only 130 reported shortfalls in some items, while 425 rated their security adequate in every category. Critics say a checklist that companies fill out is not enough to uncover security weaknesses.
“Pay attention to missing authentication and authorization for external systems, and take a full inventory of systems connected to the internet,” the FSC told financial companies when it released the results.
The breaches at Daishin’s account-opening server, Mirae Asset Global Investments’ internal system and Bithumb’s groupware exposed the very weaknesses the FSC had flagged and raised questions over whether the firms followed the FSC’s guidance.
“The response system must shift from after-the-fact sanctions to prevention,” said Hwang Suk-jin, a professor of information security at Dongguk University. “The government should not stop at receiving reports from financial companies but should go out to the sites at a pan-government level and check whether the measures are actually being carried out.”
A keyboard and screens running computer code are displayed in this graphic from Oct. 22.REUTERS/YONHAP
The National Police Agency’s National Office of Investigation, which has been investigating an earlier string of hacks on financial companies, opened a preliminary inquiry into the securities firm and cryptocurrency exchange breaches Wednesday.
North Korean IP addresses have also turned up in scans of financial networks. Authorities warned financial companies, including cryptocurrency exchanges, about North Korean IPs in a notice shared Oct. 21 through the financial sector’s integrated security monitoring system.
About 4.4 million attempts to probe financial systems were traced to multiple IP addresses assigned to North Korea, and the authorities asked companies to check their access logs and tighten security.
Officials caution that the use of North Korean IPs alone does not show that North Korea was behind the attacks. About 40 North Korean websites, including those of the Rodong Sinmun, the Korean Central News Agency and the North’s foreign ministry, went down earlier this month.
“North Korea was also hacked on [Oct.] 20 and 21, and its main websites were paralyzed,” a financial regulatory official said. “Our analysis is that an outside party most likely hacked North Korean systems and then used North Korean IPs to attempt hacks on domestic targets.”
Experts warn that the damage could spill over to other industries.
“Hackers are concentrating on the financial sector because they judge it to be lucrative, but if AI-driven attacks spread, other industries cannot be safe either,” Hwang said. “Companies that handle large amounts of personal information, such as delivery platforms, should be especially careful.”
This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
