韩国五大银行CEO就数据泄露国会致歉，监管拟全面检查网安但市场主题已先行炒作

The chief executives of South Korea’s five major commercial banks apologized for recent personal data breaches during a parliamentary audit and pledged to increase cybersecurity budgets and staffing.
Lee Chan-jin, governor of the Financial Supervisory Service (FSS), said the regulator would thoroughly investigate the causes of the incidents and could hold bank CEOs accountable.
The heads of KB Kookmin Bank, Shinhan Bank, Hana Bank, Woori Bank and NH NongHyup Bank appeared as witnesses at the National Assembly’s audit of the FSS on Oct. 19.
The five CEOs were Lee Hwan-joo of KB Kookmin Bank, Jung Sang-hyuk of Shinhan Bank, Lee Ho-sung of Hana Bank, Jung Jin-wan of Woori Bank and Kang Tae-young of NH NongHyup Bank.
It was the first time in four years that all five bank chiefs had been summoned together to a parliamentary audit, following their appearance in 2022 amid frequent financial misconduct cases, including embezzlement.
Lawmakers questioned the banks about how they detected and reported the data breaches, the scope of customer compensation and their information security systems.
According to data released by Rep. Kim Jae-seop of the People Power Party, KB Kookmin Bank took the longest to detect the intrusion, at 67 hours and 41 minutes after the initial attack.
Hana Bank took 41 hours and 44 minutes, while Shinhan Bank took 15 hours and 26 minutes.
“I sincerely apologize to our customers and the public for causing concern over an incident at a financial institution where trust is fundamental,” KB Kookmin Bank CEO Lee Hwan-joo said.
“We will secure sufficient budgets and personnel to prevent a recurrence and make every effort to counter artificial intelligence (AI)-powered hacking with AI-based security systems.”
Rep. Kim Yong-man of the Democratic Party questioned whether KB Kookmin Bank had contributed to a subsequent data breach by treating the initial intrusion as abnormal traffic and merely blocking the attacker’s IP address.
A second attack resulted in the exposure of information belonging to an additional 81 people.
Lee acknowledged the shortcomings, saying he deeply regretted that the bank had failed to block and respond to the attack more quickly.
Hana Bank CEO Lee Ho-sung said the bank would increase its cybersecurity budget and staffing and deploy AI systems to prevent similar incidents.
Personal information belonging to approximately 89 people was exposed in the Hana Bank breach.
Asked why the bank’s compensation plan initially lacked specific provisions, Lee said the bank had needed time to finalize the details.
“We initially waived fees, and to prevent secondary damage, we will provide full compensation if losses occur in the future, even if customers have suffered no damage so far,” he said.
Shinhan Bank suffered the largest data exposure among the banks affected by the recent intrusions.
CEO Jung Sang-hyuk apologized for the incident.
Shinhan was the only bank to issue an apology in its CEO’s name immediately after the incident and announce a full compensation plan.
However, Rep. Kim Jae-seop pointed out that only 22% of the bank’s customers had checked whether their information had been exposed, highlighting limitations in the response.
Woori Bank and NH NongHyup Bank detected signs of intrusion but reported no actual data leaks. Both pledged to strengthen their security systems.
“We receive more than 200 hacking attempts a day and had planned to increase staffing, but our efforts were insufficient,” Woori Bank CEO Jung Jin-wan said. “We will make further improvements.”
NH NongHyup Bank CEO Kang Tae-young said the bank had continued upgrading its personal information protection systems, including introducing a next-generation integrated security monitoring system in 2022, but would make additional efforts.
○ FSS Plans Comprehensive Review of Bank Cybersecurity
The FSS said it plans to conduct supervisory inspections approaching a comprehensive review of banks’ cybersecurity systems.
Rep. Kim Yong-man noted that the regulator had held seminars for bank security officials and emphasized the need to strengthen incident response capabilities as recently as June, yet the breaches still occurred.
“I question the value of simply holding meetings,” Kim said, calling for a comprehensive inspection.
FSS Governor Lee Chan-jin acknowledged practical limitations but said the regulator would expand its inspections.
“So far, we have examined samples of vulnerable areas, but going forward, we will conduct inspections approaching a comprehensive review,” Lee said.
He added that the hacking incidents could become the first cases in which CEOs are held accountable under their obligations to manage internal control standards.
His remarks indicated that responsibility for failures to prevent cyberattacks could extend beyond information security departments to bank executives.
Regarding network separation policies, Lee said a comprehensive transition would be difficult and that changes would need to be implemented in stages.
“Our approach is to minimize external exposure while checking that fundamental security measures are properly implemented,” he said.