Gopax operator Streami and exchange Pravang among 16 Korean financial firms hit by hackers

Two crypto businesses are among the 16 financial firms that South Korea's Financial Services Commission (FSC) said on Oct. 14 had been breached by hackers: Streami, the operator of Korean won market exchange Gopax, and Pravang, a coin-only exchange. The FSC disclosed the list after its second emergency response meeting, chaired by Secretary General Shin Jin-chang at the Government Complex Seoul at 3 p.m. KST, on a wave of intrusions that began in late September.

The FSC said the breaches confirmed before and after the Shinhan Bank incident span every part of the sector, including banks, savings banks, mutual credit, credit-specialized lenders, electronic financial firms, online peer-to-peer lenders and virtual asset service providers. The number could rise, it added, as firms are still checking for intrusions using the attacker IP addresses that regulators shared.

From four banks to two exchanges: the list of 16

The FSC's press materials listed the firms by sector:

• Banks: Shinhan, KB Kookmin, Busan, Hana
• Savings banks: Yegaram, Welcome, DB, OK / Mutual credit: Korean Federation of Community Credit Cooperatives (MG Saemaul Geumgo)
• Credit-specialized lenders: Hyundai Capital, KDB Capital / Online P2P lenders: PFCT, Mouda / Electronic financial business: Brightfix
• Virtual asset service providers: Streami, Pravang

A Binance-affiliated entity held a 67.45% stake in Streami as of the end of last year, Korean outlet Dealsite reported. Pravang is a coin market exchange that passed its virtual asset service provider review in December 2021 and trades coins only against other coins, with no Korean won deposits or withdrawals. The FSC did not say what or how much was taken from either company.

Two weeks that began at Shinhan Bank on Sept. 30

1. Sept. 30Shinhan Bank suffers a data leak; KB Kookmin Bank and other major financial firms are hit by cyberattacks
2. Oct. 2First emergency response meeting chaired by the FSC secretary general; attacker IPs and a security checklist sent to the whole sector
3. Oct. 4FSC Chairman Lee Eog-weon chairs an emergency inspection meeting for the entire financial sector and orders measures including blocking external access in principle
4. Oct. 8Deadline for the 12-item checklist review of 555 firms
5. Oct. 14, 3 p.m.Second meeting; 16 breached firms and checklist results disclosed

Of the 555 firms, 425 reported their status as adequate and 130 reported shortcomings. Most of the shortcomings involved one or two items related to security patches or security monitoring, with electronic financial firms and online P2P lenders showing relatively more gaps. The main shortcomings were unapplied security patches, systems left in use after manufacturer support ended, no 24-hour real-time monitoring, and missing authentication on external systems and no multi-factor authentication (MFA).

About 100,000 records including resident registration numbers; no account or card number leaks confirmed

About 100,000 records have been confirmed leaked so far, including names, contact details, resident registration numbers and email addresses, the FSC said. It said no leak of account or card numbers, which could be used directly for fraudulent payments, had been confirmed. It did not disclose how the 100,000 records break down by company.

Regulators said they are supervising the affected firms as they block attacker IPs, apply security patches and suspend affected services to prevent further damage, and notify customers of the leaks and how to respond. The Financial Supervisory Service (FSS) and the Financial Security Institute (FSI) are investigating intrusion paths and attack methods on site, and are examining whether the incidents are linked, whether they were carried out by the same attacker and whether AI-driven hacking was involved.

"It is very painful that we have found cases where financial companies are failing to keep even the basics, even though we have repeatedly ordered full inspections and tighter management following various triggers such as the Lotte Card data leak and the Mythos shock."

Shin Jin-chang, FSC Secretary General

No related notice yet on Gopax's announcement page

As of 3:30 p.m. KST on Oct. 14, Gopax had not posted any notice about the breach on its announcement page.

Korean daily Seoul Economic Daily reported on Oct. 6 that Gopax is the only one of South Korea's five major exchanges without ISMS-P certification, which adds personal data protection to the basic standard, and holds only the basic ISMS certification. A Gopax official told the paper at the time, "Investment was difficult due to cost, so we obtained basic ISMS certification first." ISMS is required to register as a virtual asset service provider, while ISMS-P is not mandatory.

The FSC said it will have financial firms inventory all external connection points across their systems and conduct a comprehensive inspection, raise vulnerability checks at large firms to at least twice a year, and require firms to share threat information they detect themselves through its integrated monitoring system, FIRST. The scope and schedule of the inspections will be set in consultation with the industry.