South Korea is widening its financial-sector security review to about 580 businesses after 37 companies reported 40 hacking incidents between September 30 and November 3. The number facing inspection describes the review’s scope, rather than the number confirmed breached.
In its November 5 announcement, the Financial Services Commission put exposed personal information at roughly 473,000 cases, including employee details and customers’ names, resident registration numbers and account numbers. It said no customer account passwords had been reported stolen. Smaller firms reported approximately KRW1 billion in stolen funds, mostly from management accounts; individual users had not been found to have lost funds.
The review covers externally reachable services, including APIs and development or test systems, alongside executive responsibilities and IT asset management. Checks of registered assets’ external connections are due by November’s end; internal-control examinations are due by year-end.
An earlier checklist did not end the response
The wider review follows an October 14 FSC update in which 16 firms had confirmed breaches involving an estimated 100,000 pieces of customer data. All 555 companies participating in a 12-point checklist exercise had completed it: 425 assessed their controls as appropriate, while 130 identified improvements. The regulator said shortcomings often involved patches or security controls, particularly among electronic-finance and online peer-to-peer lending providers.
At that stage, authorities were still examining whether incidents were connected, involved a common attacker or used AI. That matters when reading the latest announcement’s emphasis on AI defense: its policy framing alone does not establish how every intrusion happened.
Data exposure remains a consumer risk
The FSC and Financial Supervisory Service had already issued a consumer alert on October 6 about phishing and loan scams after financial-sector leaks. They instructed firms to strengthen suspicious-transaction monitoring, provide help desks and share phishing intelligence. Consumers were advised to follow preventive guidance from regulators and their financial providers.
For security teams, the review puts a practical question in focus: does the asset register match the services reachable from outside? A checklist result is useful evidence, but it needs to be tested against the actual systems, access paths and accountable owners.
