(EDITORIAL from Korea JoongAng Daily on Oct. 29)

Financial firms must invest in cybersecurity
: Recent breaches at securities firms, banks and crypto exchanges underscore the urgent need for stronger cybersecurity investment and regulatory oversight.

A series of hacking incidents at Daishin Securities, Mirae Asset Global Investments and cryptocurrency exchange Bithumb has raised fresh concerns about cybersecurity across Korea's financial industry. What began with attacks on commercial banks appears to have spread across virtually every financial sector.

The latest breaches come just a month after simultaneous cyberattacks on more than 10 financial institutions, including Shinhan Bank and Welcome Savings Bank, exposed the personal information of tens of thousands of customers. The repeated incidents raise troubling questions about whether the entire financial industry remains vulnerable to cyberattacks.

At Daishin Securities, hackers stole eight categories of personal information, including names and email addresses, belonging to 38,490 customers. The company said hackers had failed to penetrate its core business systems, preventing secondary damage such as unauthorized withdrawals of investment funds. It also pledged measures to prevent recurrence.

Yet such vulnerabilities make it increasingly difficult to counter hacking techniques that are evolving rapidly through artificial intelligence.

The problem extends far beyond Daishin Securities. An analysis by the Financial Supervisory Service (FSS) of security incidents between 2022 and August this year found that financial institutions repeatedly suffered similar breaches.

Standard Chartered Bank Korea recorded the most incidents, at 83, followed by KB Kookmin Bank with 46 and Shinhan Bank with 37. Both KB Kookmin and Shinhan were targeted in hacking incidents last month. The recurrence suggests that institutions may have failed to implement adequate preventive measures after earlier attacks, leaving themselves vulnerable to further intrusions.

FSS Gov. Lee Chan-jin warned at a meeting with bank holding company board chairs on Wednesday that simultaneous cyberattacks would become commonplace as artificial intelligence increasingly serves as a hacking tool. He called for stronger defensive systems.

His warning is justified. But financial regulators should already have been proactively inspecting individual institutions' security systems and ensuring adequate preparations before breaches occurred. They can hardly escape criticism for failing to fulfill their fundamental responsibility to protect financial consumers.

Nor can financial institutions suddenly improve their cybersecurity simply because the head of a supervisory agency demands tighter safeguards. They should have invested generously in security long ago to ensure customers could conduct transactions without fear.

Instead, many concentrated on immediate profits, including expanding sales channels, while neglecting investments essential to protecting customer information and financial assets.

Cybersecurity cannot remain a secondary consideration or an expense to be minimized. It must be treated as a fundamental obligation of financial institutions entrusted with customers' money and sensitive personal information.

Every financial institution, not merely those recently attacked, must urgently strengthen its defenses and conduct continuous security inspections.

(END)