Financial institutions need greater freedom to deploy cyber defenses, with strict accountability for protecting sensitive data and recovering from attacks.
A branch of MG Saemaul Geumgo, a Korean community-based financial cooperative, in Seoul on Oct. 14, after authorities received a report that the institution had been targeted in a cyberattackYONHAP
Wang Hyo-keun
The author is a research professor at Seoul Media Institute of Technology and CEO of Stealth Solution.
Financial authorities recently announced that 16 financial institutions, including banks, savings banks and finance companies, suffered cyberattacks between late September and early October, compromising approximately 100,000 records. Reports suggest that AI agents were involved in some of the attacks. Although investigators must establish the exact circumstances of the incidents, the loss of information that people expected would remain protected is undeniable.
When breaches occur, the focus is often on the number of exposed records. But numbers alone cannot measure the damage. The question should be what attackers learned and what they can do with that knowledge.
Information stolen from one commercial bank included not only names and telephone numbers but also annual incomes and borrowing limits. Someone who knows my name poses a different threat from someone who knows my earnings and borrowing capacity. Even without causing immediate financial losses, criminals have acquired information that they can exploit for deception and coercion.
Unlike physical property, data remains with its owner when copied. But attackers gain knowledge previously unavailable to them while victims lose control over their private information. Changing passwords cannot delete exposed identities or income details. If inadequate authentication exposes sensitive health records of essential national personnel or information about critical infrastructure, the consequences extend beyond privacy. Breaches threatening public safety or essential national functions become national security concerns.
Designs and manufacturing records, accumulated over decades, contain successes and costly lessons. Competitors who obtain them can bypass years of experimentation. Hacking therefore steals not merely data but time and future opportunities. Information security is an economic imperative.
The next question is how to defend that information. This breach exposed authentication weaknesses at external access points, including inquiry systems used by loan brokers. Those who neglected basic safeguards must be held accountable. But fixing elementary weaknesses is insufficient. Attackers need only discover one vulnerable entrance, but defenders must protect every entrance. AI can accelerate that search, widening the imbalance between offense and defense.
Regulation alone cannot explain these failures, but it should not also restrict defensive options. The Financial Services Commission eased network separation rules to permit external AI services for security purposes. But its second testing program, announced in September, planned to select no more than 15 companies from 75 eligible applicants. The selection schedule was subsequently delayed because of the breach response. Offensive capabilities evolve, but defensive innovation remains entangled in regulatory approvals.
Regulations can establish obligations and accountability but cannot eliminate this imbalance. Attackers follow no approved technology list. Every delay imposed on defenders becomes an opportunity for attackers.
As a result, oversight should shift from approving individual technologies toward verifying whether institutions can prevent attacks, withstand disruptions and recover afterward. The U.S. National Institute of Standards and Technology’s cybersecurity framework specifies desired security outcomes without mandating particular products or technologies. Authorities should outline clear standards while letting institutions choose their own methods. Restrictions should require government justification.
Freedom of choice entails responsibility for protection. Companies cannot evade accountability by citing authentication procedures, outsourcing arrangements or regulatory compliance. They must contain breaches, restore essential operations and protect victims. Government agencies should likewise face scrutiny over whether regulations delayed effective responses. The public should not bear the consequences simply because institutions claim that they did their best.
Data must also remain protected during use. Technologies enabling computation on encrypted information or collaborative analysis without revealing underlying records can reduce exposure. Financial institutions could jointly detect fraud without disclosing customer information, and hospitals could conduct research without compromising patient confidentiality. Such capabilities could create new industries.
This incident must not end with apologies and compliance checklists. Attackers do not wait for permission, and defenders should not have to either. Institutions need freedom to select effective defenses, accompanied by rigorous accountability for results.
Ultimately, cybersecurity policy must recognize that protecting information is not a technical exercise but a responsibility shared by companies, regulators and society as a whole.
Information security is national security, economic security and the foundation of our future. What we protect is not simply data but people’s lives, the accumulated achievements of Korea and future generations’ opportunities.
This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
