South Korea considers pan-government security body following major data leaks

President Lee Jae Myung has ordered a review of a pan-government body to coordinate security functions after the personal information of a visiting presidential delegation was exposed online. The move follows a series of global cyberattacks, including a hacking incident at Binance that resulted in approximately $6.3 billion in asset damages.

Cybersecurity issues are being raised as national security challenges that extend beyond the protection of financial assets and personal information. The global virtual asset exchange Binance announced that a hacking incident resulted in asset damages of approximately $6.3 billion, while in South Korea, it was reported that personal information, including passport numbers of a visiting delegation including the presidential couple, was exposed on the internet. Additionally, a vulnerability was discovered in PHP, which is widely used in website development, allowing commands to be executed on servers without authentication, prompting the government to request an emergency security update.

As customer information leaks continue to occur at domestic financial companies, the government has decided to strengthen its security monitoring and vulnerability inspection systems. President Lee Jae Myung ordered the establishment of a system to detect and respond to signs of attack in advance and instructed a review of the formation of a pan-government body to oversee and coordinate security functions across the public and private sectors.

[Overseas] Binance Asset Theft and Indications of Government Data Exposure

Cyberattacks targeting overseas financial institutions are causing successive damages through fund theft. ET reported that as of October, approximately 20 financial institutions had been affected by cyberattacks, and attackers are suspected of stealing funds by exploiting vulnerabilities in payment systems and account information of affiliated banks they had hijacked.

A large-scale asset theft also occurred at the global virtual asset exchange Binance. In an official notice on October 30, Binance stated that its hot wallet, used for online deposits and withdrawals, was compromised around 8:05 PM (UTC) the previous day, resulting in asset damages of approximately $6.3 billion. The company explained that it would compensate for the losses using its user protection fund and its own funds to ensure that no losses are passed on to customers.

Binance isolated the compromised infrastructure and revoked relevant access permissions. While initial investigations suggested the possibility of a laptop compromise, subsequent investigations discovered other points of intrusion. The company stated that it had not found evidence that wallet private keys were leaked at that time and is investigating the attack path with internal and external security experts.

Law enforcement agencies, blockchain analysis firms, and asset issuers participated in tracking the stolen assets. At the time of the notice, Binance stated it had secured $5 billion in tokenized assets, including stolen USDC, USDT, BTC, ETH, and BNB, and had frozen approximately $3 billion in assets on the blockchain. In a subsequent update on November 5, the company stated it had secured funds exceeding the loss amount using its own resources and had replenished approximately 98% of the damaged assets. It added that the remaining approximately 2% is being purchased through markets and over-the-counter trades, but securing them may take time due to low liquidity.

State-run bank SBI is investigating allegations of customer information leaks after receiving alerts from an external security agency. According to ET, SBI was notified of the possibility of information exposure on October 16 by a threat intelligence provider, the Defence Cyber Agency, and the India Computer Emergency Response Team (CERT-In). Preliminary investigations confirmed that among approximately 375,000 bank-related records appearing on the dark web, 3,897 customer records containing personal information were included. These records included names, mobile phone numbers, emails, dates of birth, addresses, and information related to loan applications.

In the Philippines, a security firm discovered indications that government data related to overseas employment (including certifications, contracts, accounting personnel, and Landbank records) was being exfiltrated while analyzing an attacker's intermediate server. Hunt.io announced on the 28th of last month that approximately 69GB of 27 backup databases related to the Philippine Overseas Employment Administration were copied to a server located in Singapore for about 24 minutes. Researchers secured logs remaining on the server and privilege escalation tools and reported them to the Philippine national disaster response team (CERT).

Previously, in August, indications of data theft from Philippine institutions were also confirmed. Hunt.io discovered approximately 1.2GB of data stolen from a Philippine nuclear regulatory agency and a shipping company, along with various tools, in the workspace of another attacker.

[Domestic] Customer Information Leaks at Exchanges and Securities Firms; Presidential Delegation's Personal Information Also Exposed

In South Korea, customer information leaks at virtual asset exchanges and securities firms have occurred in succession. Bithumb announced on October 29 that an unauthorized external party accessed its internal mobile groupware, Daou Office, resulting in the leak of personal information of customers and employees. The leak included 6,444 customers, and the company explained that the information of 5,600 of them was encrypted and thus the contents could not be identified. Information of 715 external personnel, including employees and partner companies, was also leaked.

The leaked items included names, contact information, resident registration numbers, account numbers, copies of identification, transaction history, and wallet addresses. Bithumb stated that no evidence was found of a direct compromise of the exchange's service system or customer database. The company has suspended the use of the groupware and has begun security inspections and supplementary measures with the developer; it also provided an inquiry service so customers can check if their information was leaked and urged caution regarding secondary damage.

Hanyang Securities stated that after confirming the leakage of customer information, it blocked external access and applied an emergency security patch through its groupware provider. The company announced on the 3rd that it confirmed the information leak on October 29 following abnormal access to its external groupware solution, and that it has been investigating the circumstances and scope of the leak and is proceeding with reporting procedures to relevant agencies. Affected customers were notified individually. The leaked data was identified as 15 items of customer information, 2 items of employee-related information, and 14 items of general personal information. This included names, contact information, addresses, dates of birth, emails, account numbers, and driver's license numbers, with 3 items containing resident registration numbers.

At Daishin Securities, the personal credit information of 38,490 customers was leaked. The company stated that it began an investigation after detecting an illegal external access attempt on October 17 and confirmed the information leak on the 26th of the same month. The leaked items consist of a total of 8 categories, including customer names, emails, addresses, communication IDs, bank names, encrypted deposit/withdrawal account numbers, Daishin Securities comprehensive account numbers, and mobile phone numbers. Daishin Securities blocked the IP addresses used in the attack and bypass IPs, and is proceeding with additional vulnerability checks and security measures. It also explained that it has strengthened monitoring of its control systems, reported to regulatory agencies, and is cooperating with investigations.

A breach also occurred at the enterprise software company DOUZONE BIZON involving its development server and backup server. The company stated on October 26 that there was illegal external access to its development server and that it is investigating the possibility that information regarding employees of its client companies was leaked. Abnormal signs were also discovered in the APO backup server, which was reported. The company explained that the backup server incident was a zero-day attack that exploited vulnerabilities in the backup solution.

DOUZONE BIZON blocked external access routes, applied protection measures to related accounts, and notified the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission of the incident. It is investigating the leakage with external professional agencies and has provided individual guidance to client companies that may be affected. The company stated, "We are already making great efforts to strengthen security by conducting information security investments worth approximately 16 billion won," and added, "Through this investigation, we will check the data management procedures and access controls of the development environment and will follow the implementation orders of the private-public joint investigation team."

It was also revealed that the personal information of the presidential couple and the personnel accompanying their overseas tour was exposed on the internet. KBS reported on November 2 that a file containing the information of 168 passengers on Air Force One was posted on a paid security-related website. The explanation is that the 'Passenger List (Republic of Korea-Belgium)' file uploaded last June included the names, affiliations, positions, dates of birth, passport numbers, and passport issuance/expiration dates of the presidential couple, government officials, security personnel, and journalists. The Ministry of Foreign Affairs of the Republic of Korea stated that it recognizes the matter gravely and will take necessary measures based on the results of the investigation into the circumstances.

The government has moved to implement emergency security measures and reorganize management systems in response to security vulnerabilities in the web development language PHP and breach incidents in the financial sector. The Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) requested immediate updates from domestic companies and institutions on October 22, stating that two serious vulnerabilities in PHP were disclosed. On the same day, the cyber crisis alert for the private sector was raised from 'Interest' to 'Attention,' and emergency response systems were activated, including increasing breach response personnel and maintaining standby emergency dispatch teams.

PHP is used to create homepages, shopping malls, bulletin boards, and administrator pages, and platforms such as WordPress and Gnuboard also operate based on it. This vulnerability is a flaw that allows an attacker to execute commands on a server by sending manipulated requests without an ID or password. Because it is a problem with PHP itself rather than individual homepages, websites can be affected even if the website programs were written securely. If an attack is successful, an attacker can install a web shell, which is a remote control file, on the server, or steal customer information and deface or paralyze homepages.

The Ministry of Science and ICT guided operators to check the PHP versions of their running systems and restart web services after security updates. It also instructed that servers that have already completed updates should check for abnormal connection records and the presence of web shells. These response guidelines were disseminated to companies required to report Chief Information Security Officers (CISO), web hosting companies, and Internet Data Centers (IDC), and the ministry is continuously monitoring attack trends in cooperation with domestic and international security industries.

Bae Gyeong-hun, Deputy Prime Minister and Minister of Science and ICT, stated, "There are limits to defending against attacks with the existing method of patching within a few days after a manual check," and added, "An automated response system is needed, such as the immediate blocking of internet contact points and the preemptive application of web application firewall rules."

Financial authorities conducted investigations into breach incidents at financial companies and inspections of security management systems. According to data released by the Financial Services Commission on the 14th of last month, incidents were confirmed at 16 financial institutions, including banks, savings banks, mutual finance, and virtual asset service providers, around the time of the Shinhan Bank breach incident. The scale of the information leak identified at that time was approximately 100,000 items, including names, contact information, resident registration numbers, and emails. The Financial Services Commission explained that the number of companies where incidents are confirmed may increase as financial companies check for additional breaches based on shared attacker IP addresses.

In a checklist inspection conducted on 555 financial companies, 130 reported deficiencies in security management. Major issues identified included the failure to apply the latest security patches, lack of management for systems whose manufacturer technical support has ended, failure to establish 24-hour monitoring systems, omission of authentication and authorization for external systems, and failure to implement multi-factor authentication for critical services. The companies involved have submitted supplementary plans and begun taking measures such as applying security patches, replacing aging equipment, expanding monitoring personnel and facilities, and strengthening access controls.

Separately from the individual companies' supplementary measures, the Financial Services Commission plans to conduct a full-scale inspection of overall security management, including external contact points, authentication systems, and internal controls. It has decided to guide companies to manage external computing contact points as a list and clearly set authentication and access permissions for each contact point. The plan also includes specifying the reporting structures and scopes of responsibility for Chief Executive Officers (CEO), Chief Information Security Officers (CISO), and Chief Information Officers (CIO).

The threat information sharing and vulnerability detection systems will also be reorganized. The Financial Services Commission will improve systems so that information secured by financial companies during their own security monitoring processes can be shared through integrated monitoring systems (FIRST), and it will promote the construction of an AI-based inspection infrastructure to detect vulnerabilities in externally exposed assets, source code, and mobile apps. Plans are being pursued to expand vulnerability inspections and evaluations to more than twice a year for large financial companies, and the establishment of an AI-based joint security monitoring system for small and medium-sized financial companies is also under review.

At the 47th State Council meeting presided over at the Blue House on the 3rd, President Lee Jae Myung ordered a review of the formation of a pan-government body to oversee and coordinate public and private security functions. Mentioning domestic and international hacking attacks and large-scale virtual asset theft incidents, he emphasized that they must move away from the method of inspecting and responding after an incident occurs and instead establish a comprehensive prevention system.

President Lee pointed out the limitations of existing security systems, noting that hacking technology is becoming more intelligent and sophisticated due to the development of AI. As cyberattacks affect not only the daily lives of citizens but also the national economy and security, he ordered the construction of a system capable of preemptively detecting, disseminating, and responding to signs of attacks targeting vulnerabilities. He also requested the reinforcement of security vulnerabilities in major public services and national core infrastructure, such as information and communications, energy, and finance.

He also presented the necessity of an organization to coordinate security functions dispersed across ministries and agencies. President Lee stated, "Discussions on establishing a pan-government level measures body that encompasses both the public and private sectors are also necessary," adding, "I ask that you actively review the formation of a powerful and effective cyber security czar organization that can comprehensively coordinate scattered security functions."

President Lee further added, "To be a leader in the digital age, we must possess cyber security capabilities as well as semiconductors and AI."

Read the original (Korean)