From careless boardrooms to timid courts, Korea learns its digital armor is paper-thin

Once dismissed as the acts of foreign governments, obscure start-ups or the occasional reckless teenager, cyberattacks have become an immediate domestic threat.

South Korea’s largest telecoms, leading card issuers and major insurers have all seen their systems breached, customer data exposed and reputations shredded. The breaches at KT, Lotte Card and SK Telecom are not anomalies but symptoms of a systemic national vulnerability.

The numbers tell their own story. More than 7,000 corporate breaches have been reported since 2020. The curve is exponential: from 603 incidents in 2020 to nearly 1,900 last year, with this year’s tally already above 1,600 by mid-September. Six in 10 cases involve direct hacking, a sign that criminals are prying open corporate systems rather than merely duping consumers. Small and medium-sized firms account for four-fifths of reports, yet the past year has shown that conglomerates long assumed impregnable are scarcely safer.

KT’s case is emblematic. What was at first framed as a localized problem has been revealed to extend across Seoul and Gyeonggi Province. Victims were not told promptly, investigations were narrowly scoped and disclosures came in dribs and drabs. That a firm entrusted with communications and payment services should respond so grudgingly points to a deeper malaise: Cybersecurity is still treated as a compliance irritant rather than an existential priority.

Lotte Card’s behavior was scarcely more reassuring. Executives initially downplayed the breach before acknowledging it affected nearly a third of customers and included card numbers and security codes. Only when regulators pressed did the firm concede the scale. By then, consumers had mobilized lawsuits alleging both lax security and deliberate obfuscation. The claim that encryption rendered the leak harmless looked optimistic at best.

The failings are not solely corporate. The courts have shown striking leniency: only 3 in 10 convicted hackers in recent years have received prison terms, with most escaping with suspended sentences or fines. Light punishments offer scant deterrence in a business where stolen data is instantly monetizable. Nor has oversight kept pace. South Korea possesses a tangle of regulations, yet enforcement is piecemeal and reactive; data is leaked, traded and weaponized long before regulators act.

Officials have promised change. On Friday, the government announced plans to stiffen penalties, permit investigations without company disclosure and incentivize private security investment. President Lee Jae Myung called for “fundamental measures.” Yet pledges alone will not persuade a wary public. Unless fines bite, disclosure becomes mandatory and stress tests of telecom and financial systems are routine, skepticism will persist.

The technological horizon makes complacency riskier. Artificial intelligence is already being used to craft attacks that adapt in real time, evade detection and target supply chains. Under-investment will compound costs. For companies, cybersecurity is no longer a budget line but an existential risk. For government, it is not merely consumer protection but a facet of national defense.

So what should be done? Companies must abandon the fiction that security is discretionary and treat it as core to operations. Regulators must translate rhetoric into prompt, proportionate enforcement and make penalties meaningful.

To make sure that resilience is not an aspiration but a practice, policymakers should build institutional muscle through mandatory stress-tests, public-private drills and faster transfer of state cyberdefense know-how to the private sector.

Cyberattacks are not merely accounting losses. They corrode trust in the institutions that knit an economy together. The nation’s reliance on connected systems — from finance to public services — makes every breach a potential security crisis. The choice is stark: Shore up the digital circulatory system with rigor and foresight, or let the next wave of intrusions reveal just how brittle it has become.


khnews@heraldcorp.com