(EDITORIAL from The Korea Herald on Oct. 7)

False security

: AI attacks expose why Korea's financial defenses need fundamental redesign

Top security ratings mean little when an attacker simply finds another way in. The recent wave of cyberattacks on South Korean financial institutions makes that gap in protection impossible to ignore.

Seven companies, including Shinhan Bank, KB Kookmin Bank and Hana Bank, have reported personal data leaks, while others successfully blocked similar intrusions.

The attacks appear to have targeted systems connected to the outside world rather than core networks handling deposits and transfers. That distinction matters. It also offers limited comfort.

At several banks, vulnerable systems included services used by loan agents or employees. Such platforms may appear peripheral to internet banking, but they can provide access to valuable personal information.

Shinhan Bank alone reported the exposure of information belonging to about 25,000 customers, including names, phone numbers and annual income. Hana Bank reported a separate leak involving 89 customers. Police have begun investigating the attacks, while financial authorities are examining whether AI was used.

The use of AI changes the economics of the threat. An attacker no longer needs to examine every potential target. AI agents can help identify exposed systems, probe weaknesses and rapidly modify attacks, making conventional methods of reconnaissance inadequate.

Financial regulators have identified 19 IP addresses in 12 countries associated with the recent attacks, though the ultimate perpetrators remain under investigation.

The wide geographic spread points to another difficulty: A defense designed around known threats can struggle when attackers can examine many targets and change tactics quickly.

That makes the old definition of security inadequate. A certificate can confirm that procedures were followed when an audit took place. It cannot confirm that an obscure external-facing application will withstand an attack that changes as it unfolds at 3 a.m.

The contrast between affected and successfully defended institutions is instructive. Woori Bank and NH Nonghyup Bank faced similar attempts but prevented unauthorized access. Their defenses reportedly included biometric verification, restricted IP access and tighter network separation.

That should prompt regulators to rethink what they reward. Security spending remains important, but the size of a budget says little about whether a system can detect and contain an intrusion in real time.

Static certification and annual inspections should give way to regular, unannounced exercises that test every externally accessible system, including those operated by partners and contractors. Passing an inspection should not automatically confer security when it reflects little more than compliance with prescribed procedures.

The response must also become collective. A financial company that discovers a new attack route has information that could protect its competitors, yet concerns about liability or reputational damage can discourage disclosure.

Regulators should establish protections for prompt reporting and require rapid sharing of both successful breaches and attacks that were stopped. A blocked intrusion can be as valuable to the industry as a successful one, because it reveals how an attack works and where another institution may be exposed.

The urgency extends beyond finance. A separate leak at Korea Electric Power Corp. exposed information belonging to about 24,000 employees, although the company said it was unrelated to the recent AI-linked financial attacks.

The incidents need not share a culprit to point to a common problem. Critical institutions have accumulated peripheral systems as their core networks became harder to penetrate. Those outer layers can become the easiest route into sensitive data.

The country should treat financial cybersecurity as national infrastructure protection. The objective is no longer to construct a thicker wall around the vault. It is to ensure that service entrances, side doors and administrative portals receive the same scrutiny as the core systems.