South Korea Names Two Crypto Firms in Bank Data Breach List

South Korea’s Financial Services Commission listed crypto firms Streami and Pravang among 16 financial companies affected by recent customer-data breaches. The affected companies include Shinhan, Kookmin, Busan and Hana banks, along with firms from other financial sectors.

The FSC disclosed the list on Oct. 14. Streami operates the Gopax cryptocurrency exchange. The regulator estimated that about 100,000 customer-data records were exposed across the companies but did not provide a breakdown by company.

The exposed information included names, contact details, resident registration numbers and email addresses. Investigators had not identified leaked account passwords or credit card numbers as of the FSC’s Oct. 14 meeting.

The Financial Supervisory Service and the Financial Security Institute are examining how the breaches occurred, whether the incidents are connected, whether a common attacker was involved and whether artificial intelligence was used. The number of affected companies could increase as firms compare their systems with internet protocol addresses linked to the attacker and provided by authorities.

A sector-wide security check found weaknesses beyond the confirmed breaches. All 555 companies completed a 12-point self-assessment by Oct. 8. Of those, 425 reported that their security arrangements were appropriate, while 130 identified areas requiring improvement.

The reported gaps included delayed software updates, weak controls for systems no longer supported by vendors, a lack of round-the-clock monitoring and weaknesses in authentication and access controls. Companies submitted plans to address the problems and had begun corrective work.

The FSC is considering broader inspections of external connections, authentication and access controls. It is also considering clearer responsibilities for chief executives, chief information security officers and chief information officers.

One proposal would require vulnerability assessments at least twice a year, initially for larger financial companies. Financial companies and electronic financial businesses generally must test their systems annually. External websites already require checks twice a year.

The proposed measures include faster sharing of threat information, information on AI-related threat levels and systems that use AI to identify vulnerabilities. The FSC is also considering additional security support for smaller companies and changes to computer-network separation rules to allow AI-based security tools.

The scope and timetable for the inspections had not been decided. The FSC did not specify whether each proposed measure for financial companies would apply to virtual asset businesses.