The Financial Services Commission held a meeting on cybersecurity management in the financial sector with officials from related organizations on October 14. In the wake of recent hacking incidents in the financial sector, financial authorities have taken steps to immediately dispatch officials for investigation, notify affected customers about consumer protection measures available for them, and distributed the IP addresses linked to the hacking attacks as well as a self-evaluation checklist to all financial companies. At today’s meeting, authorities went over the result of checklist evaluation and discussed measures to bolster cybersecurity management to prevent data breaches in the financial sector.

Overview

At the time of this meeting, 16 companies in total have been confirmed to have experienced data breach incidents recently across all financial sectors. The extent of data breaches is estimated to be about 100,000 pieces of customer data (names, contact information, resident registration numbers, email addresses, etc.). Thus far, there have been no reported hacking incidents involving data breaches of account passwords or credit card numbers that would particularly raise the alarm about the potential of fraudulent transactions.

Authorities have instructed the affected financial companies to immediately block the IP addresses linked to the hacking attacks, employ additional measures (security patches, suspension of services, etc.) to prevent further breaches, and take all necessary steps to ensure consumer protection. In the meantime, through on-site reviews, the Financial Supervisory Service (FSS) and the Financial Security Institute (FSI) are currently looking closely into individual incidents to find out attack vectors or surface and patterns of cyberattacks to see whether individual incidents are associated with one another, whether these attacks originated from the same attacker, and whether artificial intelligence (AI) has been used in these hacking incidents.

Result of Checklist Evaluation

An evaluation on 12-point checklist has been completed by all 555 companies. A total of 425 companies reported their cybersecurity management measures as “appropriate” while 130 companies reported that they found some areas that need to be improved. Those reporting “inadequacy” were mostly related to security patches or control systems, and it appeared more in the electronic financial service and online peer-to-peer lending sectors that tend to have relatively lower cybersecurity capacity compared to more traditional sectors.

Policy Measures

At today’s meeting, authorities also discussed policy measures to bring about more lasting impact on the prevention of data breaches and financial companies’ cybersecurity management system.

First, authorities plan to carry out an exhaustive inspection on financial companies’ cybersecurity management systems to make sure that financial companies are adequately capable of effectively managing attack vectors or surface and equipped with the appropriate verification and internal control schemes.

Second, authorities will seek to improve upon the current cyberattack response mechanisms to make sure that the cyber threat risks identified by individual financial companies can also be quickly reported to financial authorities and shared with other financial companies.

Third, authorities will work to establish a regulatory ground to require financial companies to more frequently and regularly carry out cyber vulnerability tests to help bolster their cybersecurity management capabilities.

Fourth, authorities will consider expanding the provision of cybersecurity management support for small- and medium-sized financial companies to help them better respond against AI-driven cybersecurity risks.

* Please refer to the attached PDF for details.