South Korea Plans Cybersecurity Overhaul for Finance Firms After Hacks Hit 16 Companies

Published October 15, 2026, 08:15 UTC. Based on the Financial Services Commission's announcement and reporting by Cointelegraph and Analytics Insight.

South Korea's Financial Services Commission will impose tougher cybersecurity requirements on financial institutions after an investigation into hacking incidents at 16 companies, including crypto exchanges, exposed about 100,000 pieces of customer information, the regulator announced October 15, 2026.

The 16 firms and 100,000 exposed records

The FSC said an industry-wide review found cybersecurity deficiencies at 130 of 555 financial companies, and that roughly 100,000 pieces of customer information, including names, contact details and identification numbers, had been exposed across the affected firms. The affected firms include Gopax operator Streami and crypto trading platform Prabang, which previously disclosed that an October 2 hack exposed personal information of some of its customers, according to reporting by Cointelegraph.

Twice-yearly assessments for larger firms

Under the proposed reforms, larger financial institutions would undergo vulnerability assessments at least twice every year, the FSC said. The regulator also plans to strengthen information-sharing systems and hold executives more accountable, and it is considering the use of artificial intelligence in security monitoring for smaller companies.

Inspections beyond the regular schedule

The FSC said it is also considering allowing additional cybersecurity inspections outside regular assessment schedules when urgent threats emerge, as part of efforts to prevent future incidents. The regulator said it is still investigating whether the incidents involved AI use or were linked to the same attackers.

The wider Korean crackdown

The overhaul lands two days after the FSC's Financial Intelligence Unit moved to block 27 unregistered crypto exchange websites, including KuCoin and MEXC, a move MABOnChain reported on October 13, 2026. Together, the two actions mark the most aggressive phase yet of South Korea's effort to force both domestic and overseas crypto firms operating in the country into compliance.

This article is news reporting and is not investment advice.

Sources

• Financial Services Commission, October 15, 2026, primary source for the cybersecurity overhaul plan, the 16 affected companies, deficiencies at 130 of 555 financial companies, the 100,000 exposed records, twice-yearly vulnerability assessments for larger firms, stronger executive accountability, enhanced information sharing, AI monitoring for smaller companies, off-schedule inspections, and the ongoing investigation into AI involvement and whether the attacks were linked
• Cointelegraph, October 15, 2026, secondary coverage identifying Gopax operator Streami and Prabang among the affected firms and reporting the October 2 Prabang hack
• Analytics Insight, October 15, 2026, secondary coverage of the planned security inspections and early-warning measures