South Korea's Financial Breaches Expose Limits of Human-Led Security

Breaches have hit South Korean banks, savings banks, capital firms, brokerages and a crypto exchange this autumn. Financial regulators had identified 16 affected companies by mid-October. A year earlier, a card company lost data on about 3 million people. Most victims held security certifications, ran security tools and underwent regular audits.

A recent security column argues that the model of people manually blocking attacks has reached its limit. Regulators found traces of the same attacker using AI tools for mass automated attacks across several institutions. According to an overseas security firm's analysis, the attacker is an individual combining a few servers with AI, who even asked the AI where stolen financial data could be sold. The person has not been identified, and the investigation continues.

Speed is the problem

The column points to the pace of vulnerability discovery. The AI model behind this spring's "Mythos shock" reportedly found more than 10,000 high-risk vulnerabilities in a month, and AI also uncovered a decade-old flaw in PHP, used by about three quarters of websites. Attacks began four days before the patch arrived. One global report put the average time to exploitation at "minus 7 days."

The card company breached last year ran more than 500 security systems and was certified, yet one unused service engine was left out of patching, and the attacker drained data slowly over a long period. Patching alone, the author says, cannot deliver the desired outcome, and cutting technical flaws pushes attackers toward people and structures: lookup services without identity checks, shared partner servers, stolen accounts and voice phishing.

Defending the space of trust

The column's answer is zero trust, centered on visibility into what happens after an attacker passes prevention tools and is treated as a normal user. Major banks needed between 15 and 68 hours to realize they had been breached. Each request looked legitimate, but the overall flow of behavior was abnormal. The author says one compromised group can hand access to another in 22 seconds, and attackers often stay undetected for nearly two weeks.

The proposal is defensive AI that knows what normal looks like inside the network, cuts connections, revokes privileges and isolates systems automatically, while humans set principles and take responsibility. The author also urges leaders to measure security by time to detect and stop intrusions rather than by certificates, and for regulators to judge response speed. The column notes that banks cut information security spending even as incidents continued.