South Korea’s Financial Services Commission has named crypto businesses Streami and Pravang among 16 financial companies hit by recent data breaches, alongside major banks.
The FSC’s October 14 disclosure lists the two virtual asset businesses alongside Shinhan, Kookmin, Busan and Hana banks and companies in other financial sectors. Streami operates the Gopax exchange; Pravang is the other crypto business named in the release.
The FSC estimated the exposure at about 100,000 pieces of customer data across the affected companies, including names, contact details, resident registration numbers and email addresses. The FSC did not publish a company-level breakdown.
As of the October 14 meeting, authorities had not identified leaked account passwords or credit card numbers, according to the FSC’s English release.
The Financial Supervisory Service and Financial Security Institute are investigating the attack methods, whether the incidents are linked, whether a common attacker was responsible and whether AI was used. The number of affected firms could also rise as companies check their systems against attacker IP addresses shared by authorities.
A wider security check found weaknesses beyond the confirmed breach list. All 555 companies completed a 12-point checklist by October 8, with 425 reporting their arrangements were appropriate and 130 reporting areas needing improvement. The checklist was a sector-wide self-assessment.
The shortcomings were mainly in security patches and monitoring systems. Reported gaps included missing software updates, weak management of systems no longer supported by their vendors, absent round-the-clock monitoring and weaknesses in authentication or access controls. Companies submitted remedial plans and had begun taking corrective steps.
FSC plans broader checks and clearer accountability
The proposed response reaches across financial companies’ security management, from their connections to outside systems to the executives responsible for overseeing controls. The FSC plans a comprehensive review of external connections, authentication and access controls, with clearer reporting lines and responsibilities for chief executives, chief information security officers and chief information officers.
One proposal would require vulnerability assessments at least twice a year, starting with large financial companies. The existing general requirement for financial companies and electronic financial businesses is annual testing, while external websites already have to be checked twice yearly.
Regulators also plan faster sharing of threat information detected by companies, AI threat-level information and AI-based infrastructure for finding vulnerabilities. The package includes plans for more security support for smaller firms, alongside stronger CEO accountability and more effective sanctions.
The FSC also intends to accelerate consideration of easing rules on separating computer networks to enable AI-based defenses.
The inspection’s detailed scope and schedule had yet to be agreed. The release did not specify whether each proposed financial-company measure would cover virtual asset businesses.
Related coverage: CryptoSlate reported on the Financial Intelligence Unit’s separate October 13 disclosure of blocking decisions for 27 unregistered crypto websites, including KuCoin and MEXC.