FSC Links Streami and Pravang to Major Data Breach Affecting 16 Firms

South Korea’s Financial Services Commission (FSC) identified virtual asset businesses Streami and Pravang among 16 financial companies affected by recent customer-data breaches. The disclosure, released on October 14, places the two crypto firms in the same category as major traditional lenders, including Shinhan Bank, Kookmin Bank, Busan Bank, and Hana Bank. The regulator estimated that approximately 100,000 pieces of customer data were exposed across these institutions.

Scope of Data Exposure

Streami operates the Gopax exchange, while Pravang is the other crypto business named in the FSC release. The regulator stated that the exposed data included names, contact details, resident registration numbers, and email addresses. The FSC did not publish a company-level breakdown of the exposed data. As of the October 14 meeting, authorities had not identified leaked account passwords or credit card numbers. The Financial Supervisory Service and Financial Security Institute are currently investigating the attack methods. They are also determining whether the incidents are linked, whether a common attacker was responsible, and whether artificial intelligence was used in the breaches.

The number of affected firms could increase. Authorities shared attacker IP addresses with companies, who are now checking their systems against these addresses. This ongoing process means the initial list of 16 companies is not final. The sector-wide response has already identified vulnerabilities beyond the confirmed breach list. All 555 companies in the sector completed a 12-point self-assessment checklist by October 8. Of those, 425 reported their security arrangements were appropriate. The remaining 130 companies reported areas needing improvement.

Regulatory Response and New Rules

The shortcomings identified in the self-assessment were primarily in security patches and monitoring systems. Reported gaps included missing software updates, weak management of systems no longer supported by their vendors, absent round-the-clock monitoring, and weaknesses in authentication or access controls. Companies submitted remedial plans and began taking corrective steps. The FSC plans a comprehensive review of external connections, authentication, and access controls. This review aims to establish clearer reporting lines and responsibilities for chief executives, chief information security officers, and chief information officers.

One proposal would require vulnerability assessments at least twice a year, starting with large financial companies. The existing general requirement for financial companies and electronic financial businesses is annual testing. External websites are already required to be checked twice yearly. Regulators also plan faster sharing of threat information detected by companies. This includes AI threat-level information and AI-based infrastructure for finding vulnerabilities. The package includes plans for more security support for smaller firms, alongside stronger CEO accountability and more effective sanctions. The FSC intends to accelerate consideration of easing rules on separating computer networks to enable AI-based defenses.

The Financial Intelligence Unit separately disclosed blocking decisions for 27 unregistered crypto websites on October 13. This list included KuCoin and MEXC. These actions occurred alongside the FSC’s broader disclosure regarding data breaches. The inspection’s detailed scope and schedule had yet to be agreed upon at the time of the release. The FSC did not specify whether each proposed financial-company measure would explicitly cover virtual asset businesses in the final regulatory framework.