Following the revelation that the personal and credit information of 38,490 Daishin Securities customers was leaked, outside intrusions have also hit Mirae Asset Asset Management and crypto exchange Bithumb one after another, spreading security anxiety across the financial sector. With even external linked servers and business systems, not just core trading systems, becoming targets, calls are growing to raise the level of security management across financial firms.
According to the financial investment industry on the 28th, Daishin Securities detected signs of abnormal external access on the 17th on a server linked to non-face-to-face securities account opening for discretionary investment. The company blocked the internet protocol (IP) addresses and other items used in the attack and reported it to the authorities. It then examined, together with the Korea Financial Security Institute, more than 60,000 signals disguised as normal requests, and on the 26th confirmed that customer information had leaked.
The leaked information covers eight items: customer name, email, address, communication ID, bank name, deposit and withdrawal account number, Daishin Securities integrated account number and mobile phone number. Some of it, including account numbers and mobile phone numbers, was encrypted. Daishin Securities explained that no signs have been found so far that its core business systems were illegally breached or that secondary damage occurred.
Mirae Asset Asset Management also recently found that an external IP had abnormally accessed some of its web systems and that information had leaked. The company immediately cut the access path and reported it to the financial authorities, and moved to block access through a web application firewall (WAF) and suspend vulnerable functions. The leak revealed so far concerns information related to general business systems, and no traces of direct intrusion into servers or databases have emerged. It is also said that there are no signs that unique identification information such as resident registration numbers, sensitive information or personal credit information was leaked. The company is examining the cause and scope of the incident together with an outside security specialist.
Bithumb noticed on the 27th that unauthorized external access to its in-house mobile groupware had occurred and personal information had leaked. Bithumb has reported it to the relevant agencies and is checking the scale and scope of the leak, and whether exchange member information is included has not yet been disclosed.
The financial authorities also showed wariness about the string of incidents. Financial Supervisory Service Governor Lee Chan-jin said at a meeting the same day with the board chairs of the eight major bank holding companies, "I understand that a hacking incident has broadly occurred at a major financial investment firm yesterday." Of the recent breaches at financial firms, he assessed, "As the methods of cyberattacks become more sophisticated by the day, they are showing an all-around pattern, with targets expanding to non-core facilities."
Lee warned that it could become routine to use AI (artificial intelligence) hacking to find security vulnerabilities and attack many places at once. He said financial firms must build a self-defense system that finds and eliminates vulnerabilities on their own.
He stressed, "Behavior such as treating IT security as an ancillary task and complying with regulatory requirements only in form, or perceiving IT security investment as a 'cost' and not putting in sufficient manpower and resources, must not be repeated any longer." He then asked boards to take the lead in building security capabilities, since IT security is a core function underpinning the protection of customers' assets and information and trust in finance.
In the financial sector, there are also growing worries about secondary damage from the leaked personal information. Even if no monetary losses have surfaced yet, the leaked information could be used in phishing that impersonates financial firms, so the scope of damage must be determined quickly and customer protection measures hurried, they say.