Bank hacking incidents set to dominate financial sector national audit

The financial and economic sectors will enter national audit season after the holiday break, with hacking incidents at Shinhan Bank, KB Kookmin Bank, Hana Bank and BNK Busan Bank emerging as the top issue. The Ministry of Economy and Finance, the Ministry of Planning and Budget and the Financial Services Commission are each scheduled to face National Assembly scrutiny in turn, and the FSC's audit — set for Thursday — is expected to become a "hacking audit" focused on the financial regulator's oversight responsibilities and banks' lax management of external systems.

According to financial industry and National Assembly sources, the FSC will face the National Assembly's Political Affairs Committee audit on Thursday. Ruling and opposition parties are expected to closely examine the financial authorities' response to the bank hacking incidents, the scale of damage at each institution, and the process by which the breaches were detected, reported and communicated to customers.

Shinhan Bank suffered the largest breach. An outside attacker bypassed identity verification in a loan solicitor service, exposing the personal information of roughly 25,000 customers. The leaked data included names, phone numbers, annual income and loan limits, and in some cases resident registration numbers and linked identification information.

A server believed to have been used in the Shinhan Bank attack contained a string meaning "AI autonomous penetration-testing console" in Chinese. Security industry experts have raised the possibility that an open-source program called ARTEX AI was used to automate vulnerability scanning and attack-path configuration. However, neither the financial authorities nor the bank has officially confirmed whether the tool was actually used in the attack.

At KB Kookmin Bank, an external intrusion into an employee mobile work-support system exposed the personal and credit information of 119 customers. At Hana Bank, an outside attacker gained unauthorized access to a sales support system and extracted seven categories of data on 89 customers, including names, resident registration numbers, addresses, email addresses, phone numbers, mobile phone numbers and employer names.

At BNK Busan Bank, the names, phone numbers, dates of birth and email addresses of 11 outsourced development staff were exposed. Similar attack attempts were also confirmed at Woori Bank and NH NongHyup Bank, though no customer data is believed to have been leaked at either institution. Police have launched a pre-indictment investigation targeting Shinhan Bank, KB Kookmin Bank, Hana Bank and BNK Busan Bank.

The incidents were concentrated not on core internet and mobile banking transaction systems but on external touchpoints such as loan solicitor services and mobile sales support systems. Analysts say this illustrates why existing network separation frameworks — which isolate internal networks from external ones — are insufficient to guard against vulnerabilities in publicly exposed web services and outsourced or sales-support systems.

The appropriateness of the FSC's push to ease network separation regulations is also expected to come under scrutiny at the audit. The FSC has been running a pilot program that temporarily relaxes network separation rules for select financial firms, allowing them to use AI to scan vast amounts of source code for vulnerabilities — on the rationale that if attackers are using AI to find weaknesses, financial firms must be able to use AI to defend themselves.

Ruling and opposition lawmakers are expected to press hard on whether adequate alternative security controls were put in place as network separation rules were loosened, and whether financial firms managed their attack surfaces to include publicly exposed systems and partner companies. The accountability of financial firms' CEOs and chief information security officers, as well as compensation standards for customer damages, could also become points of contention.

The introduction of single-stock leveraged ETFs and the resulting concerns about market volatility and investor protection are also expected to feature prominently. Other issues likely to be raised include allegations of conflicts of interest surrounding the employment of sons of former presidential office Policy Chief Kim Yong-beom and Financial Supervisory Service Director Lee Chan-jin at Mirae Asset Global Investments, as well as real estate finance policies such as restrictions on jeonse loans for non-resident single-home owners.

The Ministry of Economy and Finance will face the National Assembly's Finance and Economy Planning Committee audit on Tuesday, with the Ministry of Planning and Budget following on Thursday. Key issues are expected to include the government's proposed comprehensive real estate tax overhaul, broader tax reform measures, next year's budget, plans for using surplus tax revenue and the direction of a proposed future response fund.

A financial product calendar also gets under way. Applications for the second round of the Youth Future Savings Account open Wednesday. The product is a three-year flexible savings account that allows monthly deposits of up to 500,000 won ($368). The government contributes 6 or 12 percent of deposits as a matching grant depending on the enrollment type, and interest income is exempt from tax.

During the first enrollment round, some applicants received incorrect eligibility screening results due to a system error. Financial authorities have since improved the screening process for the second round, including providing advance notification of preliminary screening results.

A series of major economic indicators will also be released. The ASEAN+3 Macroeconomic Research Office will publish its updated Regional Economic Outlook on Monday. AMRO had forecast South Korea's growth rate at 1.9 percent in April before revising it up 1.2 percentage points to 3.1 percent in July.

The Bank of Korea will release end-September foreign reserve figures on Tuesday. Reserves stood at $442.28 billion at the end of August, up $14.33 billion from the previous month — the largest single-month increase on record.

August balance-of-payments data will be released Thursday. The cumulative current account surplus from January through July this year reached $233.09 billion, roughly four times the $59.82 billion recorded in the same period last year. With semiconductor exports continuing to perform strongly, attention will turn to whether August extended that record-setting current account surplus streak.