16 Financial Institutions Hit by Cyber Incidents, Around 100,000 Records of Data Exposed... Investigation Under Way Into Whether the Same Attacker and AI Were Used

Financial-sector cyber incidents have been confirmed across multiple industries, with incident-hit companies found before and after the Shinhan Bank incident. The sectors affected include banks, savings banks, specialized credit finance companies, electronic financial companies, online investment-linked finance companies, virtual asset service providers, and mutual financial institutions. The incidents have spread across all sectors.

A total of 16 companies have been confirmed to have experienced financial-sector cyber incidents. The amount of information exposure identified so far is around 100,000 records. The exposed data items include names, contact information, resident registration numbers, and email addresses.

Financial companies are continuing to check for additional breaches. As a result, the number of incident-hit companies could increase further.

Financial authorities are investigating whether the incidents are related. They are also investigating whether the same attacker was involved. They are likewise examining whether AI was used in the attack process, but that has not yet been confirmed.

The Financial Services Commission held the '2nd Emergency Response Meeting' on the 14th, chaired by Secretary-General Shin Jin-chang. The agenda included the progress of the financial-sector cyber incident investigation, the results of emergency security inspections, and institutional reform measures to prevent recurrence.

The companies confirmed to have suffered data exposure are Shinhan Bank, KB Kookmin Bank, Busan Bank, Hana Bank, Yegaram Savings Bank, Welcome Savings Bank, DB Savings Bank, OK Savings Bank, Hyundai Capital, Korea Development Bank Capital, PFCT, Mouda, Brightfix, Streami, FraBank, and the National Credit Union Federation of Korea, for a total of 16 companies. The amount of information exposure confirmed so far is around 100,000 records.

The FSC said that no exposure has been confirmed of information such as account numbers or card numbers that could directly lead to fraudulent payments. However, because names, contact information, and resident registration numbers were exposed, concerns are being raised about secondary damage from misuse of personal information.

Financial authorities are requiring the companies involved in the incidents to take additional breach-prevention measures. Specifically, they ordered blocks on attacker IP addresses, security patches, and suspension of related services, while also overseeing consumer-protection measures that inform customers of the data exposure and how to respond to it.

The Financial Supervisory Service and the Financial Security Institute are carrying out on-site investigations. The investigations are analyzing the intrusion path and attack methods, verifying whether the attacks were carried out by the same actor, and checking for the possibility of AI hacking. The connection between the incidents has not yet been confirmed. Other financial companies are checking whether they were breached based on shared IP addresses, and the scope of damage could expand further.

In response to the chain of cyber incidents, emergency security inspections were conducted on financial companies, and those inspections found cases of inadequate basic management.

This inspection covered 555 financial companies and was conducted according to a 12-item checklist. Each company submitted its inspection results by the 8th. Of those, 425 companies submitted 'appropriate,' while 130 companies reported deficiencies.

The 130 companies reporting deficiencies represent about 23.4%. However, these 130 companies do not refer to the number of companies where incidents occurred; rather, they refer to the number of companies that said improvements were needed based on the security inspection.

Major deficiencies included failure to apply the latest security patches, poor management of systems whose manufacturer support had ended, lack of a 24/7 real-time monitoring system, failure to authenticate and authorize external systems, and failure to introduce multifactor authentication (MFA) for critical services. Most companies were found to need improvements in one or two items related to security patches and monitoring systems.

Deficiencies were found relatively often in the electronic financial and online investment-linked finance sectors. These sectors are characterized by relatively weaker security capabilities.

Those companies submitted implementation plans. The plans included security patches, replacement of aging equipment, expansion of monitoring staff and facilities, broader authentication coverage, and stronger access controls. The companies are carrying out remedial measures.

Following the emergency inspection, financial authorities are pushing ahead with a full-scale inspection of overall security management. The full-scale inspection is aimed at identifying external access points that could be used as entry paths for attackers.

The full-scale inspection will also include checks of authentication and access control, along with internal control reviews. Financial authorities plan to catalog all external access points in financial companies' IT systems, keep the list up to date, and clarify authentication and access privileges for each point.

Financial authorities plan to guide and oversee the improvement of reporting structures for CEOs, CISOs, and CIOs, as well as their respective areas of responsibility. The specific scope and schedule of the inspections will be finalized after consultation with the financial industry.

Financial authorities are pushing to expand the sharing of threat intelligence. At present, hacking threat information identified by the Financial Supervisory Service and the Financial Security Institute is being disseminated to the financial sector through the integrated monitoring system (FIRST) and other channels, but information identified through companies' own monitoring processes is not currently being shared, the FSC said. Accordingly, the scope of sharing is being expanded to include information captured through companies' own monitoring efforts for joint use.

The authorities plan to improve systems such as the integrated monitoring system for sharing threat information among financial companies so that threat information sharing and joint response can happen more quickly. The goal is to allow other companies to quickly identify and respond to attack indicators discovered by one company. The authorities also plan to strengthen the joint response framework.

The authorities are also pushing ahead with an AI-based threat-level information system for financial companies. The system is intended to help users intuitively assess the severity of threats. In addition, they are pursuing the establishment of an AI-based infrastructure that examines externally exposed assets, internal source code, and mobile app vulnerabilities from the attacker’s perspective.

The authorities also plan to strengthen the vulnerability inspection and assessment system. According to the FSC, under the current system financial companies and electronic financial businesses must undergo vulnerability inspections and assessments once a year. The FSC said that, under the current system, external websites are subject to mandatory vulnerability inspections and assessments twice a year.

The authorities are pushing to expand the inspection and assessment cycle to at least twice a year, starting with large financial companies that have many external access points and large customer bases. They are also pushing to include important external access points as mandatory inspection targets. The authorities are also considering establishing a basis for conducting ad hoc inspections when there is an urgent need.

Financial authorities have decided to supplement security response systems to cover small and midsize financial companies and industries not subject to the Electronic Financial Transactions Act. Accordingly, for small and midsize financial companies, the Financial Security Institute plans to review a plan to build an AI-based joint security monitoring system together with industry associations and federations, and to push ahead with black-box testing to inspect the attack surface. They also plan to prepare customized security guides. For lending businesses and insurance agencies (GA) that are exempt from the Electronic Financial Transactions Act, they have decided to disseminate response guidance and review measures to strengthen security for lending businesses and insurance agencies (GA).

Shin Jin-chang, Secretary-General of the Financial Services Commission, said that despite repeated calls for full-scale inspections and stronger management, cases of noncompliance with basic security management were found. He added that the authorities will re-examine the entire security framework, including external access points, authentication management, security monitoring, and the responsibilities of CEOs and boards of directors, and will also push ahead with fundamental institutional reforms.

Source: IT DAILY · Lee Jae-young
Original: https://www.itdaily.kr/news/articleView.html?idxno=242188

References

• https://www.itdaily.kr/news/articleView.html?idxno=242188