KB Kookmin took 68 hours to detect its intrusion, against 15 at Shinhan

Detection time is the figure a periodic security check cannot move. According to incident reports obtained by Korean lawmakers, Shinhan took about 15 hours to detect its intrusion, Hana 42 hours and KB Kookmin 68 ^[7]. The mean is about 42 hours ^[13], and KB Kookmin waited 4.5 times as long as Shinhan ^[14]. An inspection samples a system on one date. It cannot say how long an intruder sat inside between dates, and that is the gap Fong was pointing at when she said organizations must move beyond a "compliance-based mindset" centered on periodic checks ^[1].

Singapore's reporting rule shows where its clock starts. Under amendments implemented in October 2025, specified incidents at designated critical infrastructure operators must be reported within two hours of becoming known ^[9]. If Korea set a similar rule, KB Kookmin's regulator would hear at hour 70 at the latest ^[16]. Faster reporting trims the last two of those hours and leaves the first 68 alone.

The thesis can fail in a few places. Monitoring limits damage, and Singapore's own case shows it does not guarantee entry is blocked: hackers linked to UNC3886 got into the four leading telecom operators ^[10], the response ran more than 11 months, attackers penetrated some systems and took limited technical information, and authorities reported no service disruption ^[11]. The exposure may also sit outside anything a bank would think to monitor. Microsoft's Mike Yeh told The Korea Herald that large organizations often rely on contractor-built software, sometimes through "independent projects that may not be supported anymore" ^[12], and the Korean intrusions ran through apps used by employees and loan brokers ^[6]. And one firm's monitoring helps its peers only if the findings travel. The FSC acknowledged that threats individual firms detect on their own have not been shared through FIRST ^[8].

We think the continuous-monitoring argument fits these banks on the evidence of the clock, with a limit. The FSC's inspection found weaknesses at 130 of 555 firms, or 23.4% ^[15], and insufficient monitoring is one of three named categories ^[5]; The Korea Herald does not break the 130 down by category. The view is wrong if the slow detections trace to unsupported contractor software that no monitoring covered, in which case an inventory of those apps comes before any new monitoring contract. Either way, budget spent preparing for the next inspection is not spent watching the loan-broker apps.