Financial companies, including banks and insurance firms, failed to detect financial accidents such as system errors or hacking for over a month after they occurred, with 91 cases reported over the past four years. Among these, 17 cases were only discovered a year after the incidents occurred.
According to data submitted by the Financial Supervisory Service to Kim Hyung-yeon, a member of the Rebuilding Korea Party, on the 19th, there were a total of 2,189 cases of electronic financial accidents and hacking-related breaches reported to the FSS from 2022 to August of this year.
Among these, 91 cases were identified only after a month (30 days) had passed since the incidents occurred, involving 43 companies. There were 75 cases at 32 financial companies, including banks and insurance firms, and 16 cases at 11 electronic financial businesses, such as simple payment and payment processing companies. Of these, 17 cases remained undetected by the financial companies for over a year after the incidents.
The company that detected the incident latest was Lotte Insurance. It identified a system program error that occurred on November 1, 2023, only on April 21 of this year, 902 days later. Toss Bank also discovered a program error that occurred on May 7, 2022, 670 days later on March 7, 2024. AIA Life Insurance likewise identified a program error that occurred in November 2024 after 621 days had passed.
Hana Bank discovered a program error that occurred in April of last year after 507 days. It compensated 112 customers who were affected by the incident with 7.14 million Korean won. Shinhan Bank also identified a program error that occurred in December 2023 after 471 days had passed.
Similar issues were confirmed at electronic financial companies, including simple payment services. T Money discovered a program error that occurred in January 2024 only in March of last year, 428 days later. The company compensated 6,071 customers affected by the incident with 7.27 million Korean won.
Detection was also delayed in information leakage incidents. Payment processing company Aximbay became aware of an information leakage incident that occurred in October 2022 only in August 2023, 309 days later. iM Bank identified an incident caused by a security vulnerability after 178 days. Even Lotte Card, which experienced a large-scale personal information leak last year, took 19 days from the date of the malicious code breach incident to detect it.
However, most of the belatedly discovered incidents were system program errors, not hacking. Among the 91 cases detected only after 30 days from the incident occurrence, 81 cases (89%) were program errors. There are calls for financial companies to not only prevent external hacking but also regularly check whether their internal computer systems are functioning properly.
Rep. Kim Hyung-yeon said, “If banks fail to detect incidents for months after they occur, who can consumers trust?” and added, “It is necessary to examine whether the financial sector’s accident prevention and response systems and the financial authorities’ management and supervision are functioning properly.”
Leave a Reply