South Korea to Inspect 170 Private-Sector IT Systems After Bank Breaches

The measures come after 16 commercial banks reported cyberattacks that led to breaches of customer data this year, according to Yonhap. President Lee Jae Myung has expressed concern over such attacks and called for the country to develop cybersecurity methods suited to the artificial intelligence era, the report said.

Separately, a Korea Herald editorial carried by Yonhap said the government raised its private-sector cyber alert from "interest" to "caution," the second-lowest level in its four-tier system, after two serious vulnerabilities were disclosed in PHP, a programming language widely used for websites and online services. The flaws could allow remote attackers to run code on affected servers, the editorial said.

The editorial said police have said an AI-assisted hacking operation targeted more than 90 domestic companies and allegedly stole 8.2 million records containing personal information. The PHP vulnerabilities and the alleged intrusion campaign are separate cases, it said, but both show how automation can turn a software weakness into a large-scale breach.

The editorial focused on the gap between issuing an alert and confirming that affected systems have been repaired. It said large organizations may have teams capable of auditing systems and applying updates promptly, while small clinics or online shops whose websites were built years ago by outside contractors may lack comparable capacity, and an update could disrupt the service on which their business depends.

Government oversight is also incomplete, according to the editorial. During a parliamentary audit, the Korea Internet and Security Agency said it could not determine how widely vulnerable PHP versions remained in use at public institutions or whether all fixes had been installed, and it cited limits on its authority to inspect systems directly. Because responsibility is split among agencies and sectors, no single body has a complete view of the systems that remain exposed, the editorial said.

The editorial called for authorities to maintain an up-to-date inventory of software running on critical services and to assign clear responsibility for applying and confirming each fix. It also said operators need alternatives, such as isolating a vulnerable service until it is secured, when an update is unavailable or a system cannot be repaired promptly. It called for a reliable channel for sharing threat intelligence between public agencies and private security firms, practical assistance for smaller businesses, and penalties for persistent security neglect by companies holding large volumes of personal information. The editorial said South Korea should judge its cyber defenses by the interval between warning and verified repair, adding that AI can improve detection but cannot establish who must act or ensure that anyone does.