[Insight] Hackers Did Not Target the Banks’ Vaults — The Path of Attack Has Changed

The recent cyber incidents in South Korea highlight a shift in attacker methodology within the financial sector. Instead of attempting to breach highly fortified core banking systems, threat actors are reportedly exploiting vulnerabilities in less protected, internet-connected peripheral systems. This includes platforms for employee support, loan recruitment services, and third-party software, which still provide access to sensitive customer or internal data.

This approach suggests that as financial institutions invest heavily in securing their primary transaction infrastructure, attackers are adapting by finding alternative, less defended entry points. The increasing digitalization of financial services has expanded the attack surface, creating numerous connections around the core banking network through APIs and systems operated by contractors and business partners. These peripheral systems, while not central to transactions, can still serve as conduits for data exfiltration.

The confirmed scale of data exposure varies across institutions, with Shinhan Bank reporting information leaks for approximately 25,000 customers and Yegaram Savings Bank for an estimated 40,000. While some banks, like Woori Bank and NH NongHyup Bank, detected and blocked intrusion attempts without confirming data leaks, the widespread nature of these incidents across different types of financial firms indicates a systemic challenge. Authorities are convening an emergency meeting to address these security concerns, bringing forward planned inspections after additional incidents were identified.