Hacking that began at Korean banks has reached 16 financial firms, including Gopax's operator

Start with what the itemised disclosures cover. KDB Capital counted 848 customers ^[6] and Prabang 20 users ^[7], which makes 868 people between them ^[20]. For those two firms to explain the roughly 100,000 items regulators count ^[9], each person would have had to lose about 115 items ^[21], and the leaked data includes names, phone numbers, resident registration numbers and email addresses ^[9]. We think most of the total sits at firms that have not disclosed their own losses. The headline figure is an estimate, or rather an estimate built mostly from numbers we cannot see.

DB Savings Bank muddies the count. Regulators list it among the five firms newly identified as breached ^[4], while the bank itself said its security systems blocked the attack ^[8]. If the 16 includes a firm that repelled the intrusion, the figure overstates losses by at least one (on the bank's own account). If the bank and the regulators are describing different events, the figure stands and the bank's statement is narrower than it sounds. Regulators say the number of affected companies and the scope of the damage could still change as firms continue their own investigations using the attackers' IP addresses already identified ^[11]. We'd expect the count to rise before it falls, and a tally that stays at 16 once those investigations finish would be evidence against us.

The self-assessment results need the same caution. Electronic financial services companies and online peer-to-peer lending platforms reported relatively more problems ^[13]. Shin Jin-chang, the FSC's secretary general ^[3], said it was "deeply painful that basic requirements were found not to have been properly observed at financial companies" ^[18]. But the screen is self-reported, and the article does not say whether any of the 16 breached firms sit among the 425 that rated their controls adequate ^[12]. If many do, the 23.4% of firms that flagged problems understates the exposure ^[12].

Sequencing is where we'd press. Regulators plan to revise rules to require vulnerability inspections no less than twice a year, beginning with the big financial firms: those with large user bases or with complicated systems linked to outside networks ^[16]. The inventory of externally connected systems binds every firm at once ^[14]. For smaller firms the further step is a joint monitoring system that the Financial Security Institute would build with sector associations and federations, and authorities are only considering it ^[17]. The one measure with a schedule reaches the largest firms first, and the measure for everyone else is a proposal. The counter-case is that if the breaches so far sit mostly at large firms, a size-first order is the right one.

Shin's remarks point in a second direction. Easing network separation rules while asking every firm to list each system that touches an outside network pulls two aims apart, since looser separation would presumably lengthen the list. Shin said: "We will push ahead more carefully and with greater speed on regulatory improvements, including easing network separation rules, to establish a security framework in which AI attacks are defended against with AI." ^[19]