FSS chief vows to hold CEOs accountable for hacking incidents, pushes for 3% penalty bill

Financial Supervisory Service chief Lee Chan-jin has ordered regulators to hold CEOs and other senior executives strictly accountable at financial firms where hacking incidents occurred due to inadequate basic security controls. Lee also directed staff to work actively with the National Assembly to push through an amendment to the Electronic Financial Transactions Act that would allow punitive fines of up to 3 percent of sales when security vulnerabilities are neglected and a breach results.

Lee made the directives at a management meeting Tuesday, where officials reviewed the financial sector's response to recent hacking incidents by industry and discussed measures to strengthen cybersecurity.

Lee noted the rise of AI-powered cyberattacks striking on multiple fronts simultaneously and called on financial firms to take preemptive action. Lee said firms must quickly build an enterprise-wide autonomous security framework in which they proactively identify and address security threats and vulnerabilities on their own.

Lee said securing IT safety is the foundation of customer trust and a core survival strategy, and called on CEOs, other senior executives and boards of directors to move aggressively to expand security budgets and staffing next year.

Recent hacking attacks have spread beyond traditional financial firms such as banks, securities companies and insurers to reach entities not covered by the Electronic Financial Transactions Act, which tend to have weaker IT security. Virtual asset operators and online peer-to-peer lending platforms have reported actual financial losses.

Before incidents occurred, the FSS had been guiding the financial sector through its integrated monitoring system, FIRST, and other channels to shore up gaps in basic security controls and prepare for external access point exploitation and AI agent-based cyberattacks. After breaches began in earnest, it called for emergency checklist self-inspections and the blocking of external access except where strictly necessary.

Despite those measures, the FSS concluded that compliance across the financial sector has not been sufficient, with no clear improvement evident.

Lee directed officials to closely verify whether the precautionary guidance previously issued and the self-inspections required had been properly carried out at firms that suffered breaches. Lee also ordered that large financial firms — including comprehensive financial investment business operators and insurers — be held to the same standard applied to banks, with CEOs and other senior executives facing strict accountability.

Where firms received repeated guidance but still showed inadequate basic IT controls or conducted only superficial self-inspections before a breach occurred, the FSS plans to examine whether management fulfilled its proper role and take stern action accordingly.

The FSS is also pushing for regulatory reform to strengthen financial penalties for hacking incidents. Lee directed staff to actively cooperate and communicate with the National Assembly and other parties to secure swift passage of the Electronic Financial Transactions Act amendment, which would allow punitive fines of up to 3 percent of sales when a breach results from poor basic controls or neglected security vulnerabilities.

The FSS also directed officials to find ways to encourage financial firms to strengthen security even before the law is revised. Among the options under review is a plan to apply differentiated supervisory contribution fees based on factors such as whether a firm has experienced a breach.

The FSS will also conduct a comprehensive inspection of external access points across the financial sector, deploying its own IT specialists to cover entities not subject to the Electronic Financial Transactions Act — including consumer lending firms, virtual asset operators and online peer-to-peer lenders — and will follow up to verify actual compliance.

Lee directed that firms found to have conducted only token inspections face stern action. Lee particularly ordered that external access points connected to systems handling customer or firm assets — where an attack could cause financial harm — be checked first, and that external access be blocked until vulnerabilities are resolved.

In addition, the FSS plans to establish a dedicated security unit and expand its pool of IT specialists to enable more substantive supervision and examination of financial sector IT security.

Meanwhile, Hanyang Securities confirmed that a hacking attack carried out Thursday through an external groupware solution resulted in the partial leak of customer and employee information. Hacking incidents are mounting across the financial investment sector — following banks, Daishin Securities and Mirae Asset Global Investments have also been hit.