Financial Supervisory Service cyber supervisors testified Thursday that they lacked statutory authority to grant quiet periods when mid-sized brokerages asked to delay customer notifications after September credential-stuffing campaigns hit trading APIs.

September wave

According to briefing slides shown to the National Assembly’s political affairs committee, three securities firms logged more than 41,000 automated login attempts in a 36-hour window after stolen mobile-banking passwords appeared on a Telegram channel. Two firms forced password resets for affected accounts within hours; the third initially sought a 72-hour hold on public comment while engineers patched a legacy WebLogic gateway.

FSS Director for Electronic Finance Park Min-su said regulators denied the delay request, citing rules that require customer notice once personal data may have leaked. The brokerage instead issued a same-day alert through its app and SMS gateways, a move lenders on the committee praised but technology vendors criticized as premature before root-cause analysis finished.

41,000 automated login attempts in 36 hours

Shared infrastructure risks

Hackers pivoted from the securities APIs to test the same password lists against credit-card mobile apps, according to the Financial Security Institute’s weekly bulletin. No card issuer reported successful fraudulent charges, yet fraud teams said the overlap justified mandatory multi-factor authentication on any account that can move cash to a brokerage wallet.

Opposition lawmakers pressed for names of vendors whose API gateways appeared in multiple incident reports. Park declined to identify firms, citing ongoing prosecutions, but confirmed that two incidents involved unpatched middleware versions flagged in an April industry alert.

Policy response

The FSS said it will publish binding timelines for customer notification by year-end and expand on-site inspections to cloud subcontractors that host order-management systems. Committee members asked whether the regulator should emulate Singapore’s requirement that retail brokers block outbound transfers for 12 hours after a password change; Park said the idea would be studied in a December task-force report.

For customers, the hearing underscored a familiar lesson: when broker APIs wobble, card-linked accounts may be probed next, and regulators will not postpone disclosure to spare corporate public-relations teams.