40 hacks at 37 Korean financial firms in five weeks; regulator to inspect 580

01Sixteen firms on 14 October, 37 by 3 November

On 14 October the FSC counted 16 companies and about 100,000 pieces of customer data.² By the cut-off for its 5 November meeting the count stood at 37 companies and 40 incidents.¹ The Korean release says who the later reports came from: since the sector-wide checklist finished on 14 October, breaches have mainly been reported by small and mid-sized securities firms and insurers, electronic-finance companies, peer-to-peer lenders and crypto exchanges.³

The count is already behind events. Mirae Asset Securities says outsiders got in on 4 and 5 November, after the FSC’s cut-off.⁶ On 6 November the FSC extended its special response period, due to end on 5 November, to the end of December, saying more leaks were still being confirmed.⁴

02Every part of finance reported one; electronic-finance firms the most

The FSC’s list runs across nine sectors. Electronic-finance companies are the largest group at ten; banks number four.¹ A hint of this came on 14 October. All 555 firms had filled in a 12-point self-assessment; 425 rated themselves “appropriate” and 130 reported something to fix, mostly security patches or control systems. Those gaps appeared more in electronic finance and peer-to-peer lending, which the FSC said “tend to have relatively lower cybersecurity capacity”.² The FSC has not said how many of the 425 that rated themselves appropriate were later breached.

The FSC names no firm. Companies have named themselves: Daishin Securities, Mirae Asset Global Investments and the crypto exchange Bithumb in late October,⁷ and Mirae Asset Securities, days after sister companies including Mirae Asset Life reported leaks of their own.⁶

03What was taken, and a sentence that reads differently in Korean

The English release says the records were “mostly pertaining to the information about employees, and the names, resident registration numbers, and account numbers of customers”.¹ Read quickly, that sounds like mostly employees. The Korean original lists the two together: mainly employee information or customers’ names, resident registration numbers and account numbers, collected in the course of business.³ The FSC publishes no split between staff and customers. What it does say is that account passwords and other information that could enable fraudulent payments have not been confirmed as leaked.³

The money is about ₩1 billion, or about US$745,000 by Yonhap’s conversion.⁶ Small crypto, electronic-finance and peer-to-peer firms reported it. The English says it came “mostly from their management accounts”;¹ the Korean is more specific: crypto hot wallets, spendable points and peer-to-peer deposits, in accounts where the company holds customer money together.³ The FSC says individual users have not yet lost funds, and that as of 6 November no customer money had been reported lost to voice phishing or smishing tied to these leaks. Its consumer alert, first issued on 6 October, stays at Level I, Caution.³⁴⁵

04Where the FSC says they got in, and what it now requires

Only the Korean release says it plainly. The inspection covers authentication and access-control systems, sales and management APIs, and development, test and temporary-operation systems, which the FSC calls “the systems where recent breaches have mainly occurred”, along with peripheral systems it thinks have been neglected (our translation).³ The English version lists the systems without that phrase.¹ The firms’ own accounts fit: Daishin, a server linked to remote account opening; Mirae Asset Global Investments, a work web system; Bithumb, an internal mobile groupware app;⁷ Mirae Asset Securities, a mobile-web phone-authentication login and an internal system.⁶

The sixth step runs the other way from what a reader might expect. Korean financial firms have had to keep internal networks apart from external ones; the FSC now wants that rule gone, so firms can use AI on defence, with zero trust and other substitutes in its place.¹³ Its summary line is that AI attacks are to be defended with AI.³

A financial company that cannot protect its customers’ information and assets has already lost its reason to exist.³

05India's NBFC wave: the same side doors, a different kind of loss

India’s lenders have been under attack in the same weeks, and the entry point looks familiar. CERT-In’s advisory of 4 November describes “Internet-exposed non-production environments (UAT/staging/testing) used as entry points, followed by movement to production environments using shared credentials, tokens or network paths”.⁹ The FSC names development and test systems too.³ Neither regulator links the two waves. What differs is what went missing, and who has counted it.

Korea’s wave, so far, is mainly about records. India’s, as reported, is about money moved through payment and disbursement APIs: The Economic Times put losses at small NBFCs at about ₹300 crore, citing unnamed sources,¹⁰ and a police complaint read by Reuters puts one case, two Mumbai lenders and more than 700 transfers, at about US$2 million.¹¹ That single reported case is more than Korea’s reported total of about US$745,000.⁶ We covered the Indian figures and who stands behind them in our 1 November note.