0
KB Kookmin Bank CEO Lee Hwan-ju (from left), Shinhan Bank CEO Jung Sang-hyuk, Hana Bank CEO Lee Ho-sung, Woori Bank CEO Jung Jin-wan, and NH NongHyup Bank CEO Kang Tae-young take an oath as witnesses during the National Assembly National Policy Committee's audit of the Financial Supervisory Service and other agencies on the 19th. / Asia Today Reporter Lee Byung-hwa

As hacking attacks exploiting AI recently struck the entire financial sector—including commercial banks, savings banks, and capital finance companies—personal information leaks occurred at lenders including Shinhan Bank, KB Kookmin Bank, and Hana Bank. As the severity escalated with the cyberattacks causing cascading damage across the financial sector, the heads of all top five commercial banks appeared as witnesses at the National Assembly audit of the Financial Supervisory Service (FSS) and bowed their heads in apology.

Terms for all five bank chiefs expire at the end of this year, and observations suggest that this hacking crisis could deal a blow especially to Shinhan Bank CEO Jung Sang-hyuk, who is seeking an unprecedented third term at the lender. This is because Shinhan Bank suffered the largest damage among the top five lenders, and having the smallest information security budget also adds to calls holding Jung accountable. KB Kookmin Bank CEO Lee Hwan-ju, whose reappointment had been widely anticipated on the back of strong business performance, was likewise unable to avoid the fallout from the hacking crisis. Furthermore, observations suggest that the impending leadership transition at KB Financial Group is also likely to weigh heavily on Lee's reappointment prospects.

The National Assembly National Policy Committee's audit on the 19th was conducted on the Financial Supervisory Service. Alongside controversies over single-stock leveraged exchange-traded funds (ETFs) that caused tens of trillions of won in investor losses, the AI hacking incidents that recently struck savings banks, capital finance firms, and the five major lenders—Shinhan, KB Kookmin, Hana, Woori, and NH NongHyup—were addressed as core agenda items during the FSS audit. At the audit that day, all five bank chiefs—Shinhan Bank CEO Jung Sang-hyuk, KB Kookmin Bank CEO Lee Hwan-ju, Hana Bank CEO Lee Ho-sung, Woori Bank CEO Jung Jin-wan, and NH NongHyup Bank CEO Kang Tae-young—attended as general witnesses.

Representative Kim Jae-sub of the People Power Party pointed out, "Shinhan Bank suffered the greatest damage among the five major lenders. KB Kookmin Bank was far too late in recognizing its hacking breach. There is an exceptionally high probability that this information was leaked to brokers who sell databases, and it will ultimately continue to be traded in ways that facilitate voice phishing and illegal private lending."

Representative Kim continued, "While Shinhan Bank stated it would compensate affected customers, only around 5,000 customers have actually checked whether their information was leaked. KB Kookmin Bank showed an irresponsible attitude by shifting the burden of proving damages, and Hana Bank is said to lack even concrete compensation guidelines. Is this the attitude of banks that feel accountability?"

Regarding this hacking crisis, all five bank chiefs bowed their heads, saying, "We are sorry." They also spoke in unison that they would secure adequate budgets and manpower and make every effort to prevent a recurrence of such damage.

Representative Park Seong-hoon of the People Power Party pointed out, "Shinhan Bank has a standing auditor who previously served as president of the Financial Security Institute, yet it still failed to prevent hacking damage," questioning, "Did the bank merely need the title of someone from a supervisory authority? It is questionable whether proper procedures for financial security and internal control were being followed." Representative Park also emphasized, "KB Kookmin Bank's execution rate for its information security budget was only 58%, and the unexecuted budget included projects essential for improving security authentication systems and access controls."

Representative Kim Yong-man of the Democratic Party pointed out whether the failure to promptly detect the breach when KB Kookmin Bank was targeted first ultimately caused cascading hacking incidents. Representative Kim also pressed the lender on tip-offs alleging cover-up instructions inside KB Kookmin Bank, such as "deleting logs." KB Kookmin Bank CEO Lee Hwan-ju explained, "It remains deeply regrettable that we were unable to promptly block and respond to the breach," but clarified, "I gave no instructions regarding log deletion, nor did I receive any reports related to it."

Representative Kim also pointed out that banks including KB Kookmin Bank should not be viewed merely as victims regarding the hacking crisis, emphasizing that the FSS needs to conduct a comprehensive inspection of information security across the financial sector. Financial Supervisory Service Governor Lee Chan-jin stated, "We will ensure that compliance duties under internal control standards will be treated as an issue where CEO accountability is addressed, likely marking the first such case related to a cybersecurity hacking incident."

Meanwhile, observations suggest that this AI hacking crisis will also exert a substantial influence on the reappointment of the heads of the five major lenders. This is because major financial groups including Shinhan Financial, KB Financial, and Hana Financial commenced proceedings last month to select chief executives of subsidiaries whose terms are nearing expiration, with all five bank chiefs facing the end of their terms at the close of this year.

In particular, Shinhan Bank CEO Jung Sang-hyuk, having successfully served one renewal, has headed the bank for four years. While seeking to become the first bank president to secure a third term since the launch of the integrated Shinhan Bank in 2006, the hacking crisis is expected to serve as a significant burden. Political pressure is also fierce. Earlier on the 8th during the National Assembly audit of the Financial Services Commission, Representative Kim Hyun-jung of the Democratic Party pointed out, "Regarding the Shinhan Bank crisis where 25,727 customer records were leaked, legal liability should be held against Shinhan Bank CEO Jung Sang-hyuk as the ultimate person responsible for internal control, and he must take responsibility through clawbacks of unpaid bonuses and damages."

A new variable has also emerged for KB Kookmin Bank CEO Lee Hwan-ju, whose reappointment expectations had run high due to solid business performance during his tenure. Like CEO Jung, this hacking crisis could act as a negative factor, and Division Head Lee Jae-keun is scheduled to be inaugurated as chairman of KB Financial Group next month. Having sharply elevated bank performance over the past two years and overtaking Shinhan Bank to claim the leading bank position during his first term, Lee was assessed as highly likely to be reappointed. Given that previous bank heads had likewise served one reappointment, Lee's second term had been expected to be smooth sailing.

However, evaluations are also emerging that the mood within the group has recently turned less favorable.

                                                                                                            Cho Eun-guk 

                                                                                                             Chae Jong-il