A report on the information security incident of SinoPac Bank will be submitted today, and the Financial Supervisory Commission will not fully investigate

Today is the deadline for SinoPac Bank to report a "major incident" regarding its security incident. According to regulations, SinoPac Bank must submit a written report to the Financial Supervisory Commission before the end of today. As for whether to impose a penalty on Sino-Fung Bank, what is the possible penalty? The Financial Supervisory Commission emphasized that relevant deficiencies will be investigated and reviewed, and everything will be handled in accordance with procedures and will not preset a position.

In response to the security incident in which hackers stole funds from Sino-Fung Bank, Zhang Jiakui, deputy director of the Banking Bureau, said that banks have strengthened the protection of the "front office" and "back office". In particular, this time it happened in the "middle office", and the Financial Supervisory Authority will require financial institutions to carry out comprehensive protection. He said that SinoPac was the "middle platform" where external hackers used the supplier's security settings to invade the bank's new online banking app transaction system, resulting in the unidentified transfer of more than NT$40 million in customer funds. The relevant disputed transaction system has not been introduced by other banks. The Financial Supervisory Commission has asked SinoPac to conduct a comprehensive investigation and clarify the real cause of the attack.

Zhang Jiakui said that Wing Fung Bank must submit a complete investigation report before November 12 to clarify the real cause of the incident and related deficiencies. According to the investigation, this incident affected a total of 418 customers, 427 abnormal transactions, and a total of 41.76 million yuan in remittances; Wing Fung Bank returned all the transferred amounts to users in the form of advances on the afternoon of the 3rd.

The Banking Bureau emphasized that it will further review the supply chain management mechanism based on the investigation results and deficiencies of this case, and discuss and improve relevant self-regulatory regulations based on the reasons for external hackers to invade the system, and strengthen the management of outsourced manufacturers and supply chains by financial institutions.

As for the outside world's concern about the bank's middle-end system, are there security loopholes and how will the Financial Supervisory Authority strengthen protection? Zhang Jiakui said that the Financial Supervisory Commission has issued a financial security action plan, which sets out relevant specifications and requirements for information security protection capabilities, operational continuity and information security monitoring. He emphasized that after this incident is further clarified, the Financial Supervisory Commission will also continue to strengthen the joint information security prevention mechanism of the financial industry through liaison meetings with the chief security officers of financial institutions.

How to effectively prevent external hackers from exploiting supplier vulnerabilities? The Banking Bureau stated that current regulations and relevant information security self-regulatory regulations in the financial industry have required banks to implement outsourced vendor and supply chain risk management, including background and security investigations of partner vendors, as well as relevant information security management measures. The Financial Supervisory Commission also requires vendors to ensure that their systems are free of malicious programs and backdoors.