Opposition party blames regulators over bank hacking spree

The People Power Party raised questions Saturday about financial regulators' responsibility for a string of hacking incidents and customer data breaches at major commercial banks, calling for a comprehensive review of externally accessible financial systems and a full accounting of events from the initial intrusion to the authorities' response.

Park Sung-hoon, the PPP's chief spokesperson, said in a statement that "bank security is the last line of defense for the financial system that protects the assets and credit of the public," adding that the incidents should be seen as "an alarm bell for South Korea's financial security defense network, going beyond a simple personal data leak."

Shinhan Bank recently confirmed that personal and credit information belonging to about 25,000 customers had been stolen. Data breaches were also confirmed at KB Kookmin Bank, Hana Bank and Busan Bank. Woori Bank and NH NongHyup Bank were also targeted by external hacking attempts, but no data leaks have been confirmed at either institution so far.

"If a hole has been punched in that line of defense, it cannot be dismissed and patched up as an isolated incident at individual financial firms," Park said. "Before worrying about cutting-edge AI hacking, we cannot help but ask whether the basic 'front doors' of the financial sector are properly locked."

Park also said regulators bore significant responsibility. "While calling for AI-driven financial innovation and digital transformation, was the supervisory framework that should underpin all of that actually in place?" he said.

"Reactive measures — investigating after a breach, reviewing after a theft — cannot stop the cyber threats of the AI era that lie ahead," Park said. "At this national audit, we will go through everything one by one: who missed the warning signs, and whether the financial authorities' oversight was actually working."

Choi Eun-seok, the PPP's floor spokesperson, also issued a statement Saturday, asking, "What was the banks' monitoring system doing while customers' information was being taken?" and saying "the vicious cycle of apologizing when an incident occurs, only for the same thing to happen again shortly after, must now end."

Choi also said the Lee Jae Myung government's financial authorities could not escape responsibility, urging them to "fully disclose the cause of the incidents, the scale of the damage, and the gaps in the response process, and hold those responsible strictly accountable for any confirmed failures."

The Financial Services Commission has already convened an emergency meeting with the Financial Supervisory Service, the Korea Financial Security Institute and major banks and card companies, and has directed financial firms to conduct their own security reviews.

The PPP said it plans to use the national audit to examine not only the security systems of individual financial firms but also whether regulators' advance oversight and anomaly detection and reporting mechanisms functioned as intended.