South Korea financial hacking widens to online lenders; authorities cite weak controls

In short

Intrusion incidents have hit seven South Korean banks, savings banks and a capital firm, and the online investment finance companies PFC Technologies and Mouda said in notices that they were breached, according to Yonhap. Leaked data volumes varied widely — 25,727 records at Shinhan Bank against 153 at KB Kookmin Bank and 89 people at Hana Bank, with Yegaram Savings Bank reporting about 40,000 records and Welcome Savings Bank 2,200 — while Woori and NH Nonghyup banks said they blocked the attempts. Financial authorities said the strength of multi-factor authentication, access management and internal controls decided who was breached, and set emergency inspection deadlines of Oct 6 for banks and card firms and Oct 8 for others.

Why it matters

The attacks touch banks, savings banks, a capital firm and online lenders at once, exposing how unevenly basic security controls were applied across South Korea's financial sector. Authorities and the industry face emergency inspections through Oct 8 and a likely parliamentary audit this month, while the financial regulator says secondary fraud using leaked data cannot be ruled out. For customers, the practical consequence is company-specific: exposure varies from a few dozen people at one bank to tens of thousands of records elsewhere.

Key facts

• Yonhap reported that intrusion incidents have occurred at seven companies: Shinhan, KB Kookmin, Hana and BNK Busan banks, Yegaram and Welcome savings banks, and Hyundai Capital. [ 2 ]
• Online investment finance (온투업) firms PFC Technologies (PFCT) and Mouda disclosed breaches through notices, and Seoul Shinmun reported that online lenders serving mid-credit borrowers were also hit. [ 1 , 2 ]
• Leak sizes differed sharply: Shinhan Bank 25,727 records, KB Kookmin Bank 153, Hana Bank 89 people, Yegaram Savings Bank about 40,000 records and Welcome Savings Bank 2,200, while Woori and NH Nonghyup banks said they defended successfully. [ 2 ]
• Authorities said the same attacker IP appeared in the commercial bank incidents but differed from the IPs used at savings banks and capital firms, while attack methods were similar. [ 2 ]
• Securities, insurance and card companies were exposed to hacking attempts but have reported no damage so far. [ 2 ]
• Financial Services Commission Chairman Lee Eok-won cited externally exposed IT assets and services, authentication and access control, and intrusion detection systems as objects of inspection, saying checks should leave no gaps in the security system. [ 2 ]
• Banks and card companies must finish emergency inspections by Oct 6, and securities, insurance, savings banks and electronic finance businesses by Oct 8. [ 2 ]
• Officials and experts said the level of routine system management and internal controls, including multi-factor authentication and encryption, determined whether each company was breached; an emergency meeting of the whole financial sector the previous day made the same point. [ 2 ]

What local media are saying

Timeline, local time

1. 23:57Seoul Shinmun reports that online investment finance companies serving mid-credit borrowers were also hit by the hacking. [ 1 ]
2. 05:45Yonhap reports seven financial companies with intrusion incidents and the online lenders' notices, and that the whole financial sector held an emergency inspection meeting the previous day. [ 2 ]