South Korea names two crypto firms in data breach sweep

South Korea names crypto firms Streami and Pravang in data breach wave

South Korea's Financial Services Commission (FSC) has named two virtual asset companies, Streami and Pravang, among 16 financial firms hit by recent customer data breaches. The disclosure came on October 14 alongside major banks including Shinhan, Kookmin, Busan and Hana banks.

Streami operates the Gopax crypto exchange, while Pravang is another crypto business. The FSC did not specify which types of data were leaked at each company, only that about 100,000 pieces of customer information were exposed across all affected firms.

Key details of the breach

• About 100,000 customer data items were exposed across the 16 affected companies.


• Data included names, contact details, resident registration numbers and email addresses.


• No leaked account passwords or credit card numbers have been identified as of the October 14 meeting.


• The FSC did not release a company-level breakdown of the data exposure.

What regulators are investigating

South Korean authorities are looking into how the breaches occurred, whether the incidents are linked, whether a single attacker is responsible and whether AI was used in the attacks. The number of affected firms could also rise as companies check their systems against attacker IP addresses shared by authorities.

A wider self-assessment found security gaps at many companies. All 555 firms completed a 12-point checklist by October 8. Of those, 425 reported their security arrangements were appropriate, while 130 reported areas needing improvement. Common shortcomings included missing software updates, weak management of unsupported systems, absent round-the-clock monitoring, and weaknesses in authentication or access controls.

Planned security reforms

The FSC outlined several proposals to strengthen the financial sector's cybersecurity. These include requiring vulnerability assessments at least twice a year for larger companies, faster sharing of threat information, and AI-based tools for finding vulnerabilities. The regulator also plans clearer accountability for chief executives, chief information security officers and chief information officers.

One proposal would accelerate consideration of easing rules on separating computer networks to allow better AI-based defenses. The detailed scope and schedule for these measures have not yet been agreed upon.

Uncertainty remains

The FSC release did not specify whether each proposed security measure would cover virtual asset businesses. It also remains unclear how many of the 16 companies are crypto-specific versus traditional financial firms.

Why this matters

The breaches affect both crypto and traditional financial sectors in South Korea, highlighting that virtual asset companies face the same cybersecurity risks as established banks. Regulators appear to be pushing for a sector-wide security overhaul rather than targeting crypto firms specifically.

What comes next

The FSC will continue inspecting financial companies and developing new security requirements. The investigation into the attack methods and whether a common attacker is responsible is ongoing. Companies have submitted remedial plans and begun taking corrective steps for the gaps identified in the self-assessment.

Related coverage

In a separate October 13 action, South Korea's Financial Intelligence Unit disclosed blocking decisions for 27 unregistered crypto websites, including KuCoin and MEXC. Those actions targeted unregistered exchange sites and are distinct from the current data breach investigation.

Sources

• CryptoSlate