KB Kookmin Bank leads big five in cybersecurity spending at W86.08b

The five major South Korean banks diverged in their cybersecurity budget allocations this year. KB Kookmin Bank, Hana Bank and NH NongHyup Bank all increased their security spending from last year, while Shinhan Bank and Woori Bank cut theirs.

According to data that People Power Party lawmaker Park Dae-chul of the National Assembly's Political Affairs Committee obtained from the Financial Supervisory Service, KB Kookmin Bank set aside the largest cybersecurity budget among the five banks this year at 86.08 billion won ($64.3 million).

NH NongHyup Bank came in second at 80.13 billion won, followed by Hana Bank at 63.63 billion won and Woori Bank at 61.57 billion won. Shinhan Bank posted the smallest allocation at 40.59 billion won.

In terms of cybersecurity spending as a share of total IT budgets, Hana Bank ranked highest at 12.2 percent. NH NongHyup Bank stood at 10.5 percent, KB Kookmin Bank and Woori Bank each at 9.9 percent, and Shinhan Bank at 9.1 percent.

The year-on-year trends also diverged by institution. While KB Kookmin Bank, Hana Bank and NH NongHyup Bank expanded their security budgets from last year, Shinhan Bank and Woori Bank reduced theirs. Woori Bank's cybersecurity budget fell 21.7 percent to 61.57 billion won from 78.66 billion won last year, while Shinhan Bank's dropped 10.4 percent to 40.59 billion won from 45.29 billion won over the same period.

In recent hacking incidents, Shinhan Bank suffered the largest customer data breach, with information on about 25,000 customers exposed. KB Kookmin Bank and Hana Bank each reported smaller leaks, affecting 119 and 89 customers, respectively.

The banking industry is now reviewing plans to increase cybersecurity investment next year in the wake of the incidents, recognizing that the growing sophistication of hacking methods has made it more urgent to expand security personnel and systems.

"The share of IT spending that companies and financial firms devote to information security does not appear to be sufficiently high," Park said. "Relying solely on after-the-fact sanctions and outdated regulations will make it difficult to meet the personal data protection standards the 21st century demands."

He added that policy incentives should be used to create an environment in which companies willingly invest in IT and information security on their own.

Meanwhile, recent hacking incidents across the financial sector exposed roughly 100,000 personal records from 16 financial institutions. A review of 555 financial firms by financial regulators found security management deficiencies at 130 of them, or 23.4 percent.