SKN | South Korea Plans Cybersecurity Overhaul After Attacks Hit Banks and Crypto Firms

Key Points

• South Korea’s Financial Services Commission plans tougher cybersecurity requirements after a review identified security deficiencies at 130 of 555 financial companies.
• Approximately 100,000 pieces of customer information were exposed across affected firms, including names, contact details and identification numbers.
• Proposed measures include twice-yearly vulnerability assessments for larger institutions, stronger executive accountability, improved threat monitoring and expanded information sharing.

South Korea Targets Cybersecurity Gaps Across Financial Sector

South Korea is preparing stricter cybersecurity requirements for financial institutions after a review uncovered security deficiencies across the sector and examined incidents involving 16 companies, including cryptocurrency businesses.

The Financial Services Commission (FSC) said it would pursue stronger threat monitoring, more frequent security assessments and greater accountability for executives responsible for cybersecurity. The measures follow an industry-wide review that identified deficiencies at 130 of 555 financial companies.

According to the regulator, approximately 100,000 pieces of customer information were exposed across the affected firms. The compromised information included names, contact details and identification numbers, highlighting the potential consequences of weaknesses in financial institutions’ security systems.

The proposed overhaul reflects efforts to strengthen defenses against cyberattacks as financial services providers, including cryptocurrency platforms, manage sensitive customer information and digital financial infrastructure.

Crypto Platforms Among Affected Companies

The firms identified in connection with the incidents include Streami, the operator of cryptocurrency exchange Gopax, and crypto trading platform Prabang.

Both platforms had previously disclosed that a hack on October 2 exposed personal information belonging to some customers. The incidents have added cryptocurrency businesses to the broader cybersecurity review involving South Korea’s financial sector.

The FSC has not yet established whether the incidents involving the affected companies were connected or whether attackers used artificial intelligence to carry them out. Investigations into those questions remain ongoing.

Determining whether the incidents share a common source could help authorities understand the methods used and identify potential weaknesses across multiple organizations. However, the regulator has not confirmed that a coordinated campaign was responsible.

Proposed Rules Would Increase Security Assessments

Under the proposed reforms, larger financial institutions would be required to undergo vulnerability assessments at least twice a year. More frequent testing would give organizations additional opportunities to identify weaknesses before attackers can exploit them.

The FSC also plans to strengthen information-sharing systems so that financial companies can exchange relevant cybersecurity information more effectively. Better coordination could help institutions respond to emerging threats and recognize attack patterns affecting multiple firms.

For smaller companies, the regulator is considering the use of artificial intelligence in security monitoring. Such tools could help identify suspicious activity, although the FSC has not detailed the specific systems or implementation requirements under consideration.

The proposals also include the possibility of additional cybersecurity inspections outside regular assessment schedules when urgent threats emerge. This would give authorities greater flexibility to examine institutions when security concerns require more immediate attention.

Executive Accountability Under Review

The planned changes would also strengthen accountability for executives overseeing cybersecurity at financial institutions.

By placing greater emphasis on management responsibility, the FSC aims to reinforce cybersecurity as an organizational priority rather than treating it solely as a technical issue.

The approach would complement more frequent vulnerability assessments and improved threat monitoring. Institutions would need to identify weaknesses, assess their exposure and maintain procedures for responding to security incidents.

The regulator has not yet provided a complete implementation timetable for the proposed reforms or specified all potential consequences for companies that fail to meet the new requirements.

Outlook

South Korea’s planned cybersecurity overhaul follows a review that found security deficiencies at nearly one-quarter of the 555 financial companies examined. The exposure of approximately 100,000 pieces of customer information underscores the importance of stronger security controls across banks, financial services providers and cryptocurrency platforms.

The next steps will depend on how the FSC finalizes and implements its proposals, including the scope of mandatory assessments and the additional oversight available during urgent threats. Investigators must also determine whether artificial intelligence played a role in the incidents and whether the affected companies were targeted by the same attackers.