The Financial Services Commission (FSC) is leading the response and is holding meetings with industry bodies, regulators, and officials from impacted financial institutions to discuss the next steps. FSC Chairman Lee Eog-weon warned that finance companies must remain on high alert as the authorities trace the source of the cyberattack.
The security breach investigation was initiated after Shinhan Bank notified the FSC about the incident on September 30.
Following that, regulators opened on-site inspections and expanded the probe as more financial institutions reported a cyberattack. Shinhan Bank and KB Kookmin Bank were the two financial firms named by the FSC, while Yonhap News Agency reported that Hana Bank and Woori Bank also experienced data leaks.
FSC decided to call an emergency meeting of senior officials to review the situation, moving it from its original date, October 7.
According to Korean media, the main reason for the emergency meeting was related to the fact that more financial institutions became victims of cyberattacks, and that additional breaches at secondary financial institutions were also suspected.
Regulators are also considering the possibility that AI might be involved in the cyberattack. Lee warned that the involvement of AI in the cyberattack cannot be ruled out and that the response should be based on AI-driven cybersecurity solutions.
In addition, the FSC is considering implementing enhanced cybersecurity measures for the finance sector.
Among the first steps taken by the FSC is a recommendation that financial institutions conduct a cyber hygiene review. FSC urged finance companies to implement stricter access controls, reduce the exposure of their systems, and introduce additional measures to protect consumers from potential data abuse.
Furthermore, the FSC is pressuring financial institutions to share information about the cyber incidents.
The information exchange process should include attack methods, internet protocol (IP) addresses, and other details. It would enable financial companies to develop a joint response and recognize other potentially impacted entities.
The cyberattack might have been targeting financial hubs rather than the single institution, according to one scenario produced by South Korean regulators and reported by Yonhap. The unnamed regulators believe that the cyber attackers targeted several financial institutions in an attempt to scan the system to find weaker areas.
According to the information provided by the banks to the National Assembly, the cyberattack came from various IP addresses. Those locations spanned across several countries, including the US, Japan, Singapore, Vietnam, and the UK.
South Korea’s opposition People Power Party is demanding that the government investigate whether North Korea was behind the cyberattack.
The cyberattack could be a retaliation for decades of cyber espionage and economic sabotage by Pyongyang, according to the party.
The response from the FSC is to keep investigating the cyber incidents and urge financial institutions to boost their cybersecurity measures and share information about the cyber incidents.
