South Korea’s Financial Services Commission (FSC) set a year-end cybersecurity review timetable for about 580 financial firms and related operators after reported incidents were linked to an estimated 473,000 exposed records.
The review covers internet-accessible assets, including application programming interfaces, along with employee, internal business and partner systems. It will examine the duties of chief executive officers (CEOs), chief information security officers (CISOs) and chief information officers (CIOs), as well as companies’ external access points and IT asset inventories.
The FSC set Nov. 30 as the target for completing checks of registered external-facing systems. Reviews of unregistered systems and internal-control structures involving CEOs and CISOs are scheduled for completion by Dec. 31. A firm that finds a serious vulnerability threatening finances or data must shut the affected service and cut off outside access, the FSC said. The requirement can interrupt affected operations while the firm addresses the risk.
The commission said 37 financial firms reported 40 cybersecurity incidents between Sept. 30 and Nov. 3. The estimated 473,000 exposed records included employee information and customer names, resident registration numbers and account numbers. As of the announcement, the FSC had not identified leaks of account passwords or similar information that could enable unauthorized payments.
The FSC also reported thefts totaling about KRW 1 billion from company-managed funds at some smaller virtual-asset exchanges, electronic financial businesses and online investment-linked finance operators. It said no individual users had incurred financial losses by then.
Separately, The Korea Herald reported that some financial institutions are considering internal projects for 2027 to strengthen executives’ security duties. The newspaper cited an unnamed accounting industry official who said firms were considering the projects internally but had made no formal requests for outside consulting. It also cited an unnamed securities-industry official who said one company was reviewing its responsibilities map through an internal task force.
South Korea’s amended Act on Corporate Governance of Financial Companies took effect July 3, 2024. It requires firms to allocate internal-control duties among executives through responsibilities maps and gives CEOs companywide oversight duties. The FSC says firms must obtain external system-vulnerability checks at least annually; it plans to phase in twice-yearly checks for large financial companies. The commission expects to release its security internal-control guidelines in the first quarter of 2027.
