South Korea Seeks Centralized Cybersecurity Control

South Korea’s National Intelligence Service has ordered emergency cybersecurity checks at more than 2,100 public institutions. President Lee Jae Myung is also urging officials to consider a new government-wide body with authority across public and private sectors. The moves follow attacks that exposed personal information at financial firms. People whose data was exposed now face calls to accept more centralized oversight as the answer.

Who Gets the Power

At a Cabinet meeting on Tuesday, Lee called for “a comprehensive prevention system” against threats he said endangered the national economy, security and people’s everyday lives. He said increasingly sophisticated hacking techniques, fueled by artificial intelligence (AI), were exposing the limits of existing security systems.

Lee asked officials to “proactively consider the formation of a cybersecurity czar agency” that could serve as a strong control tower for security management. He also called for discussions about a pan-government agency responsible for cybersecurity across public and private sectors. The distinction matters: Lee instructed officials to consider these bodies; the article doesn’t say anyone has established them.

The proposed structure would place security management under a central agency and extend its reach across sectors. Lee instructed officials to address weaknesses at major state institutions and key infrastructure, including information communications, energy and finance. He wants to replace a system that relies on inspections and responses after incidents. “The existing security system, which centres on inspections and after-the-fact responses, is showing clear limitations,” he said.

The Cost of the Breaches

The directives followed attacks on South Korean financial firms that exposed customer information. Recent breaches involved Mirae Asset Global Investments, crypto exchange Bithumb and Daishin Securities. Local financial institutions—including banks, savings banks and insurance companies—also suffered attacks the previous month, exposing about 100,000 cases of personal information, including email addresses, names and phone numbers.

The damage falls on customers whose personal details became exposed, while officials debate how to reorganize the institutions responsible for security. The article doesn’t describe customers organizing a response or receiving support through mutual aid. So far, its account of action centers on government instructions, institutional inspections and proposed agencies.

Lee’s remarks also followed the theft of more than US$6 billion worth of cryptocurrency from Binance, described as the world’s largest cryptocurrency exchange. The U.S. Federal Bureau of Investigation (FBI) blamed North Korea for the theft. Lee referred to the Binance incident without directly naming North Korea, and North Korea denied involvement on Nov. 3.

Inspections as the Immediate Response

The National Intelligence Service asked 2,100 public institutions to conduct emergency cybersecurity inspections. It called on central government agencies and local governments to use a checklist for their checks, while launching emergency inspections covering more than 2,100 central government ministries, local governments and public institutions.

The NIS planned separate vulnerability assessments of critical information and communications infrastructure in the public sector under its jurisdiction. Officials expected to finish those assessments by mid-November. The agency also directly assessed internet-facing systems at public-sector facilities designated as critical information and communications infrastructure. It highlighted possible cyberattack entry points, security-monitoring systems and security patches.

The response described here is administrative: public institutions check their systems, while a state agency inspects designated facilities. Lee’s call for a government-wide task force would extend that apparatus across public and private sectors. The stated aim is to protect public services and critical infrastructure; the immediate facts remain exposed customer data, emergency checks and a proposed new center of control.