Five bank chiefs apologise at National Assembly audit over hacks, pledge security spending
In short
The heads of KB Kookmin, Shinhan, Hana, Woori and NH Nonghyup banks appeared as witnesses at the National Assembly Political Affairs Committee's audit of the Financial Supervisory Service on 19 October. The heads of KB Kookmin, Shinhan and Hana apologised for customer data leaks, and KB Kookmin and Hana pledged more security budget and staff. Lawmaker Kim Jae-seop said Shinhan took 15 hours 26 minutes to detect its attack, Hana 41 hours 44 minutes and KB Kookmin 67 hours 41 minutes.
Read the full story 2 min read
The heads of five major banks appeared on 19 October as witnesses at the National Assembly Political Affairs Committee's audit of the Financial Supervisory Service, over a series of hacks in the financial sector. They were Lee Hwan-joo (이환주) of KB Kookmin Bank, Jung Sang-hyuk (정상혁) of Shinhan, Lee Ho-sung (이호성) of Hana, Jung Jin-wan (정진완) of Woori and Kang Tae-young (강태영) of NH Nonghyup. The committee voted on 8 October to summon them. Yonhap and Chosun Ilbo said it was the first time all five were audit witnesses together since the audit of 11 October 2022, when embezzlement and internal control were at issue. [ 1 , 2 , 4 , 9 , 15 ]
Jung Sang-hyuk said he felt sorry when asked by lawmaker Kim Jae-seop of the People Power Party whether he felt responsible. Lee Hwan-joo apologised to customers and the public and said he would secure enough budget and staff, and build security on the assumption of AI-assisted hacking. Lee Ho-sung said he was sorry for the AI hacking damage and would add budget, staff and AI-based systems. Jung Jin-wan said Woori was not hit but was lucky this time. Kang Tae-young said the control system built in 2022 would be upgraded this year and next. [ 9 , 15 ]
Kim presented data on how long banks took to notice the attacks: 15 hours 26 minutes for Shinhan, where 25,729 customers had data leaked; 41 hours 44 minutes for Hana, with 89 customers; and 67 hours 41 minutes for KB Kookmin, with 119 people. Kyunghyang Shinmun quoted Kim as saying savings banks were worse, with Yegaram taking 14 days and Welcome about five days. [ 9 , 15 , 16 ]
Compensation was a second focus. Kim said only 5,682 of Shinhan's 25,729 affected customers, about 22 percent, had checked whether their data leaked. He criticised the phrase 'proven damage' in KB Kookmin's compensation notice as shifting the burden of proof to victims, and said Hana had no specific compensation policy. Lee Ho-sung replied that compensation is only normal if damage occurs, that there is no damage so far, and that Hana would pay in full if damage arises. He said fees were being waived and financial safety insurance would be offered with customer consent. Asia Economy reported that Han Chang-min of the Social Democratic Party called a pledge of full compensation only for secondary damage wordplay, and that Jung Sang-hyuk replied Shinhan plans full compensation for about 25,000 people. [ 9 , 15 , 20 ]
Over KB Kookmin's response, Democratic Party lawmaker Kim Yong-man said the hacker entered KB Kookmin first without an active response. Lee Hwan-joo said he deeply regretted failing to block and respond quickly. Newsis reported a tip that an executive ordered logs deleted; Lee said he had not been told. [ 11 , 21 ]
Financial Supervisory Service governor Lee Chan-jin said chief executives' responsibility would be addressed for the first time in a cyber-security hacking case. The audit also covered single-stock leveraged ETF reviews and lending rates. Yonhap and Asia Economy reported lawmakers asking whether the bank heads, whose terms end this year, deserve to stay on. [ 1 , 2 , 14 , 16 , 21 , 22 , 23 ]
Why it matters
Financial Supervisory Service governor Lee Chan-jin said the responsibility of chief executives would be addressed in a cyber-security hacking case for the first time. The bank heads' terms all expire at the end of this year, and lawmakers questioned whether they deserve to stay on.
Key facts
- The five bank heads testified as ordinary witnesses at the Political Affairs Committee's audit of the Financial Supervisory Service on 19 October. [ 2 , 4 , 9 , 15 ]
- It was the first time all five bank heads were audit witnesses together since the audit of 11 October 2022, according to Yonhap and Chosun Ilbo. [ 2 , 4 ]
- Lawmaker Kim Jae-seop said Shinhan took 15 hours 26 minutes to detect the attack, Hana 41 hours 44 minutes and KB Kookmin 67 hours 41 minutes. [ 9 , 15 , 16 ]
- Kim said 25,729 Shinhan customers had data leaked, along with 89 at Hana and 119 at KB Kookmin. [ 9 , 16 ]
- Hana Bank head Lee Ho-sung promised full compensation if damage occurs later, and said fee waivers are in place. [ 9 , 15 ]
- Woori Bank head Jung Jin-wan said Woori was not hit but was lucky this time, and that more than 200 hacking attempts arrive daily. [ 9 , 15 ]
- Financial Supervisory Service governor Lee Chan-jin said chief executives' responsibility would be addressed for the first time in a cyber-security hacking case. [ 14 , 16 , 21 ]
Confirmed by several sources
- Lee Hwan-joo (KB Kookmin), Jung Sang-hyuk (Shinhan), Lee Ho-sung (Hana), Jung Jin-wan (Woori) and Kang Tae-young (NH Nonghyup) appeared as witnesses at the Political Affairs Committee's audit of the Financial Supervisory Service on 19 October. [ 2 , 4 , 9 , 15 ]
- The KB Kookmin, Shinhan and Hana bank heads apologised at the audit for the customer data leaks. [ 9 , 12 , 14 , 15 ]
- KB Kookmin's Lee Hwan-joo and Hana's Lee Ho-sung pledged more security budget and staff and AI-based security systems. [ 9 , 14 , 15 , 16 ]
- Detection times of 15 hours 26 minutes (Shinhan), 41 hours 44 minutes (Hana) and 67 hours 41 minutes (KB Kookmin) were cited at the audit. [ 9 , 15 , 16 ]
- Governor Lee Chan-jin of the Financial Supervisory Service said chief executives' responsibility would be addressed. [ 14 , 16 , 21 ]
- The five bank heads' terms expire at the end of this year. [ 1 , 2 ]
Still unclear
- How many Shinhan customers had data leaked. Kim Jae-seop's figures give 25,729, while Dong-A Ilbo says Shinhan announced 25,727 on 28 September; other reports say about 25,000.
- Whether artificial intelligence was used in the attacks. Outlets call it AI hacking; Kukmin Ilbo said a possible AI link was raised, ZDNet Korea wrote of hacking presumed to have used AI, and Kukmin Ilbo said traces of an AI-based autonomous penetration tool were found on a server presumed used against Shinhan.
- Whether a KB Kookmin information-security executive ordered logs deleted. Newsis reported a tip to that effect; Lee Hwan-joo answered that he had not been told of it. No other document addresses it.
- How broad compensation will be. Han Chang-min called full compensation only if secondary damage occurs 'wordplay'; Jung Sang-hyuk said Shinhan is reviewing it and plans full compensation for about 25,000 people for now.
- The overall scale of the hacking wave. Only Dong-A Ilbo gives figures: 16 financial firms with confirmed breaches and about 100,000 records leaked.
What local media are saying
Timeline, local time
- On 18 October Yonhap reported the five bank heads would appear at the 19 October audit and that banks were preparing answers. [ 2 ]
- On 19 October Asia Economy published a photo of the five bank heads taking the witness oath. [ 5 ]
- Yonhap reported that the bank heads repeatedly bowed their heads before the committee. [ 6 ]
- Seoul Economic Daily reported the apologies and Governor Lee Chan-jin's remarks on chief executives' responsibility. [ 14 ]
- Newsis reported KB Kookmin's Lee Hwan-joo saying he regretted not blocking the intrusion quickly. [ 21 ]
- Asia Economy reported lawmakers from across parties questioning whether the bank heads deserve to stay on at year-end. [ 23 ]