The financial watchdog's lax supervision led to a massive leak of customer information from the nation's three major financial institutions that came to light early this year, the state auditor said Monday.

In January, an employee of the Korea Credit Bureau (KCB), a credit reference agency, was found to have stolen sensitive personal information, including resident registration numbers, bank account numbers and credit scores from Kookmin Card Co., Lotte Card Co. and Nonghyup Bank.

The three companies were ordered to suspend their business for three months from February over the leak of some 140 million customers' data, with the financial watchdog Financial Supervisory Service (FSS) taking steps to punish the heads of the affected firms.

Releasing the result of a two-month inspection into the case, the Board of Audit and Inspection of Korea said the FSS and its decision-making body Financial Services Commission (FSC) were found to have been remiss in supervising the institutions' customer data management.

The FSS was aware in 2012 that Nonghyup had illegally handed over an uncodified customer list to KCB when they placed an order with the credit reporting agency to develop a credit card security program.

But the financial regulator did not take proper preventive action, leading to the KCB employee illegally downloading the personal information of about 24.27 million customers in the latter half of 2012, according to the audit agency. 

Similar failure of supervision also took place in FSS' inspection of Lotte Card, where the KCB employee also stole 19.67 million Lotte Card users' personal data in December last year, the agency noted.

The national audit agency demanded two FSS workers in charge of the lax inspection be punished.

The FSC, for its part, failed to detect financial firms' unauthorized transfer of customer data and condoned financial companies' excessive collection of detailed customer information, the national agency said. (Yonhap)