South Korea Finds Security Gaps at 130 Financial Firms

South Korea's Financial Services Commission found security deficiencies at 130 of the country's 555 financial companies during an industry-wide review. It now wants the largest firms to face vulnerability assessments at least twice a year instead of once.

For anyone holding crypto on a South Korean exchange, the change that matters is who has to test what, and how often. The FSC's plan targets firms with wide attack surfaces and many customers first. It adds critical external access points to the mandatory inspection list. It would also make named executives answerable for how those systems are run.

The data already lost in the incidents behind the review is the kind that fuels phishing rather than instant account theft. It covers about 100,000 pieces of customer information: names, contact details, resident registration numbers and emails. The FSC said no directly fraud-usable data, such as account passwords or card numbers, has been confirmed leaked.

The regulator set out the plan after a second emergency response meeting on 14 October 2026. It was chaired by Secretary-General Shin Jin-chang. Attendees included the Financial Supervisory Service, the Financial Security Institute and the science and interior ministries. The personal data protection commission, the police and KISA also attended.

What the 12-Item Checklist Found

Officials ran a 12-item checklist across all 555 financial companies and finished by 8 October. 425 firms reported themselves adequate. 130 reported deficiencies.

Most of the 130 need fixes in one or two items, usually around security patching and monitoring. The FSC said the electronic finance and online investment-linked finance sectors have weaker security capacity. They accounted for relatively more of the failures. The problems it listed were basic ones:

• The latest security patches not applied
• Systems past their manufacturer's end of support managed poorly
• No 24-hour real-time monitoring
• Weak attack surface management, including missing authentication and multi-factor authentication on external systems

Twice-a-Year Checks and Inspections Without Notice

Under the Electronic Financial Transactions Act and its supervisory rules, financial companies and electronic finance businesses already have to run vulnerability checks once a year. External homepages get checked twice. The FSC argues that is not precise enough against fast-moving AI security threats.

Its proposal would extend the cycle to at least twice a year, starting with large firms that have wide attack surfaces and many customers. It would also bring important external access points into the mandatory inspection scope. It is reviewing a legal basis for ad hoc inspections when an urgent need appears.

Alongside that, the FSC plans to let companies share threats they detect on their own through the integrated monitoring system FIRST. It wants to build an AI threat-level information system. It also plans to stand up AI-based vulnerability inspection infrastructure that probes externally exposed assets, internal source code and mobile apps. It intends to direct firms to define reporting lines and responsibility ranges for the CEO, CISO and CIO.

The FSC is also considering a joint AI-based security monitoring system with the Financial Security Institute and industry associations. Black-box attack surface testing and tailored security guides for smaller firms are under consideration too.

Which Firms Were Hit

The FSC confirmed breaches at 16 financial companies across every sector, all around the Shinhan Bank incident. It said the count could grow as firms check shared IP addresses for signs of intrusion.

• Banks: Shinhan, KB Kookmin, Busan and Hana
• Savings banks: Yegaram, Welcome, DB and OK
• Lending and capital: Hyundai Capital and KDB Capital
• Online investment-linked finance: PFCT and Mouda
• Electronic finance: Brightpix
• Virtual assets: Streami, which operates Gopax, and Prabang
• Mutual finance: the MG Community Credit Cooperatives federation

Only two crypto firms appear on that list, and they are among the smallest names on it. For a retail holder, the exposure is narrow but specific. It is customer identity data at a platform you may have signed up to with a copy of your ID, not a withdrawal key.

What the FSC Has Not Confirmed

The FSC said it is still working out whether the cases are connected and whether the same actor is behind them. It is also looking at whether AI hacking played a part. That is based on on-site investigations by the FSS and the Financial Security Institute.

Shin called the checklist results a painful finding. Basic security practices were not followed at financial companies, he said, despite repeated orders for full inspections and stronger management. He said the FSC would push faster on institutional changes, including easing network separation rules. The aim, he said, is a security system in which AI attacks are defended with AI.

What is not settled is the inquiry itself. The attacker question is open. The power to inspect outside the schedule still needs a legal footing before it exists.