South Korea's FSC estimates 100,000 customer-data items exposed at 16 financial firms, Gopax among them
South Korea's FSC says 16 financial firms, among them four banks and the Gopax operator Streami, exposed about 100,000 customer-data items. Inspections widen first at large firms, and the release leaves open whether crypto businesses are covered.
The Investor · Invest desk
Bar showing 130 of 555 companies reported areas needing improvement in their security arrangements; the other 425 reported their arrangements were appropriate.
- Reported improvement needed, claim 7 130 of 555 companies 23% computed
Reported improvement needed The rest of the 555
| Share | Part | Whole | Percent | Claim |
|---|---|---|---|---|
| Reported improvement needed | 130 companies | 555 companies | 23% (computed) | 7 |
What happened
- As of the October 14 meeting, authorities had not identified leaked account passwords or credit card numbers, according to the FSC's English release.
- Pravang, which Sedaily spells Prabhang, posted an apology on October 9 and described blocking IP addresses used in abnormal access and tightening monitoring of suspicious logins.
- The self-reported checklist gaps were mainly in security patches and monitoring, including missing software updates and systems their vendors no longer support.
- The FSC proposes vulnerability assessments at least twice a year, starting with large financial companies.
- Gopax had not posted a notice or apology on its website as of October 15, a day after the FSC announcement, Sedaily reported, citing industry sources.
Why it matters
- Who's exposed exposure The firms that reported gaps have filed remedial plans with the regulator, so a later breach at one of them would be hard to describe as unforeseen.
- What it costs cost A large firm moving from one assessment a year to two doubles the testing its security team must schedule, scope and fix.
- What it limits constraint Until the inspection's scope and schedule are agreed, no firm can say which of the proposed measures will bind it or when.
Next story · Invest · 2d ago
Hacking that began at Korean banks has reached 16 financial firms, including Gopax's operatorConfirmed3 publishers
Divide the 100,000 exposed items by the 16 firms and the average is 6,250 each [19]. That mean describes no actual firm, since the FSC published no company-level breakdown [3], and the one firm-level count in the record is much smaller: Pravang, according to Sedaily's account of its notice, said the personal information of about 20 customers leaked on October 2 [17]. The two numbers do not subtract cleanly. The FSC counts pieces of data, among them names, contact details, resident registration numbers and email addresses [15], so one customer can account for several items.
We think 16 is a floor, or rather the first tally in a count that is still running. The FSC itself says the number of affected firms could rise as companies check their systems against attacker IP addresses shared by authorities [5]. The sector self-assessment points the same way: 130 of 555 companies, or 23.4%, reported areas needing improvement on the 12-point checklist [7][20], against 16 confirmed breaches, a ratio of 8.1 to 1 [21].
The counter-thesis is that the checklist measures housekeeping. A firm can run an unpatched system without anyone getting in, and the 130 are self-reports. We would drop the view if the IP-address checks add few or no firms to the list. We would soften it if the Financial Supervisory Service and Financial Security Institute, who are still asking whether the incidents are linked and whether a common attacker was responsible [14], find one actor with a narrow reach.
The first round of mandates goes to large firms, and smaller firms are offered more security support [9][10]. One item in the package relaxes a control: the FSC intends to accelerate consideration of easing rules on separating computer networks, to enable AI-based defenses [11].
Whether virtual asset businesses fall under each proposed measure was not specified in the release [18]. For Gopax, that gap sits beside a certification gap. Sedaily reported that it is the only one of South Korea's five largest won-denominated exchanges without ISMS-P certification [24]. An official in the cryptocurrency industry told the paper: "It is a problem that users cannot confirm the exact extent of the damage." [25]
What to watch
- Whether the list grows beyond 16 firms as companies check their systems against the attacker IP addresses authorities shared.
- What the Financial Supervisory Service and Financial Security Institute find on whether the incidents are linked, share one attacker, or involved AI.
- Whether the agreed inspection scope names virtual asset businesses, and whether Gopax posts a notice to users.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The FSC's October 14 disclosure named 16 financial companies hit by recent data breaches, including crypto businesses Streami (operator of the Gopax exchange) and Pravang, and Shinhan, Kookmin, Busan and Hana banks.
- [2]
The FSC estimated the exposure at about 100,000 pieces of customer data across the affected companies.
- [3]
The FSC did not publish a company-level breakdown of the exposure.
- [4]
As of the October 14 meeting, authorities had not identified leaked account passwords or credit card numbers, according to the FSC's English release.
- [5]
The number of affected firms could rise as companies check their systems against attacker IP addresses shared by authorities.
- [6]
All 555 companies completed a 12-point security checklist by October 8; the checklist was a sector-wide self-assessment.
- [7]
Of the 555 companies, 425 reported their security arrangements were appropriate and 130 reported areas needing improvement.
- [8]
The self-reported shortcomings were mainly in security patches and monitoring systems, including missing software updates and systems no longer supported by their vendors.
- [9]
One FSC proposal would require vulnerability assessments at least twice a year, starting with large financial companies; the existing general requirement for financial companies and electronic financial businesses is annual testing.
- [10]
The FSC package includes faster sharing of threat information and more security support for smaller firms, alongside stronger CEO accountability and more effective sanctions.
- [11]
The FSC intends to accelerate consideration of easing rules on separating computer networks to enable AI-based defenses.
- [12]
The inspection's detailed scope and schedule had yet to be agreed.
- [13]
Pravang (spelled Prabhang by Sedaily) posted a formal apology on its website on the 9th and described steps including blocking IP addresses used in abnormal external access attempts and stepping up monitoring of suspicious logins.
- [14]
The Financial Supervisory Service and Financial Security Institute are investigating the attack methods, whether the incidents are linked, whether a common attacker was responsible and whether AI was used.
- [15]
The exposed data included names, contact details, resident registration numbers and email addresses.
- [16]
Companies reporting gaps submitted remedial plans and had begun taking corrective steps.
- [17]
Pravang (Prabhang in Sedaily) said on its website that the personal information of about 20 customers had been leaked on October 2.
- [18]
The FSC release did not specify whether each proposed financial-company measure would cover virtual asset businesses.
- [19]
About 100,000 exposed data items spread across 16 firms average 6,250 items per firm.
- [20]
130 of 555 companies is 23.4% reporting areas needing improvement.
- [21]
130 firms reporting gaps against 16 confirmed breaches is a ratio of about 8.1 to 1.
- [22]
Moving from an annual baseline to at least twice a year doubles the number of vulnerability assessments a large firm must run.
- [23]
Gopax had not posted a notice or apology on its website as of the 15th, a day after the FSC announced the breach, according to financial industry sources.
- [24]
Gopax is the only one of South Korea's five largest won-denominated exchanges that has not obtained ISMS-P certification.
- [25]
"It is a problem that users cannot confirm the exact extent of the damage."
Sources
2 independent publishers whose own reporting we read for this story.
- cryptoslate.comSouth Korea names two crypto firms in breach wave that also hit major banks
1 article · October 15, 2026
- en.sedaily.comHacking Breach Disclosed, but Gopax Stays Silent
1 article · October 15, 2026
Topics and entities
Topics
- South Korea financial regulation
- Financial sector data breaches
- Crypto Exchange Regulation