Banks ramp up cybersecurity budgets for 2027 following hacking spree
A person walks past a row of automated teller machines belonging to major commerical banks in Seoul, Monday. Yonhap
Korea's major banks are sharply increasing their cybersecurity budgets for next year following a series of hacking incidents, with some lenders planning to spend more than 100 billion won ($74 million) on information security, data showed Monday.
According to data submitted by the country's four major banks to Rep. Lee Yang-soo of the main opposition People Power Party, Shinhan Bank plans to allocate 115 billion won to information security in 2027, nearly 2.8 times its budget of 40.6 billion won this year.
Hana Bank has set its budget at 100.1 billion won, while Woori Bank plans to spend 76.3 billion won. KB Kookmin Bank is also considering raising its allocation to more than 100 billion won, although the figure has yet to be finalized.
The planned increases follow a series of suspected artificial intelligence-assisted cyberattacks that have raised concerns across the financial sector.
In October, a data breach at Shinhan Bank exposed the personal information of about 25,000 customers. The number of customers affected by a separate breach at KB Kookmin Bank was 2,210, significantly higher than the bank's initial estimate of 119. Hana Bank also confirmed that personal information belonging to 89 customers had been leaked.
Yet larger budgets do not necessarily translate into stronger cybersecurity defenses.
This year's information security budget execution rates at the four banks ranged from 60 percent to 87 percent.
KB Kookmin expects to spend 52 billion won of its 86.1 billion won allocation this year, or 60.4 percent. Woori expects to spend 87 percent of its 61.6 billion won budget, while Hana has spent 23.9 billion won, or 75.3 percent, of its 31.8 billion won allocation in the first half.
Staffing is another concern as dedicated security specialists account for only a small share of the banks' IT workforces.
KB Kookmin had 1,673 IT employees this year, but only 17 were dedicated security specialists, accounting for about 1 percent of its IT workforce. Security specialists made up 6 percent of IT employees at Shinhan and 5.6 percent at Woori.
The authority of chief information security officers (CISOs), who oversee the company's cybersecurity measures, has also come under scrutiny.
All four banks' CISOs hold additional positions, including chief privacy officer roles. KB Kookmin's CISO holds five positions, including the equivalent role at the bank's New York branch.
Over the past three years, Woori was the only bank to report an instance in which its CISO put a decision on hold or exercised veto power over security concerns.