https://it.chosun.com IT조선 https://it.chosun.com/image/logo/snslogo_20240318102307.png https://it.chosun.com Sun, 01 Nov 2026 17:27:10 +0900 https://it.chosun.com/news/articleView.html?idxno=2023092173190 https://it.chosun.com/news/articleView.html?idxno=2023092173190 Fri, 30 Oct 2026 13:48:30 +0900 onej@chosunbiz.com (Han Jae-hee) According to financial industry data released on Oct. 30, KB Financial Group, Shinhan Financial Group, Hana Financial Group, Woori Financial Group and NH NongHyup Financial Group posted combined net profit of 19.63 trillion won ($19.63 trillion won) for the January–September period, up 8.6% from a year earlier. Their combined net interest income reached 40.50 trillion won over the same period. The earnings trend, however, shifted between the first half and the third quarter. While securities subsidiaries benefited from a booming stock market and led profit growth in the first six months, banks provided a more stable earnings base in the third quarter, supporting overall profitability across the financial groups. The slowdown was particularly pronounced among brokerage subsidiaries. KB Securities reported third-quarter net profit of 271.2 billion won, down 39.5% from the previous quarter. Shinhan Securities posted 65.3 billion won, a decline of 77.4%, while Hana Securities saw its net profit plunge 93.9% to 10.3 billion won. Woori Investment & Securities also recorded a 72.7% drop to 3 billion won. Although the strong stock market in the first half significantly boosted brokerages' cumulative earnings, their profit growth lost momentum in the third quarter. Banks, by contrast, delivered relatively solid results. KB Kookmin Bank reported third-quarter net profit of 1.35 trillion won, up 20.1% from the previous quarter. Hana Bank's net profit rose 17.5% to 1.19 trillion won. Shinhan Bank recorded net profit of 1.23 trillion won, down 5.9% quarter on quarter, but its decline was considerably smaller than those of securities subsidiaries. Woori Bank also posted a 22.1% increase in quarterly net profit to 1.03 trillion won. The contribution of nonbanking subsidiaries varied significantly among the five financial groups. KB Financial had the highest nonbanking earnings contribution at 40% for the first nine months of the year. KB Securities generated cumulative net profit of 1.07 trillion won, while KB Insurance contributed 681 billion won and KB Kookmin Card earned 332 billion won. The figures highlight KB Financial's diversified earnings structure, with securities, insurance and credit card operations contributing alongside its core banking business. NH NongHyup Financial followed with a nonbanking contribution of 37.2%. NH Investment & Securities recorded cumulative net profit of 1.35 trillion won, of which 800.1 billion won was attributable to the financial group after accounting for its ownership stake. NH NongHyup Property & Casualty Insurance earned 95 billion won, while NH NongHyup Life Insurance posted net profit of 6.8 billion won. Shinhan Financial's nonbanking contribution stood at 27.9%. Shinhan Securities generated cumulative net profit of 642.9 billion won, while Shinhan Card earned 485.8 billion won. Shinhan Life reported net profit of 419.4 billion won, down 18.5% from a year earlier. Hana Financial's nonbanking contribution was 21.2%. Hana Securities earned 283.4 billion won, Hana Card posted 175.3 billion won and Hana Capital recorded 144.5 billion won. However, Hana Life Insurance and Hana Asset Trust reported losses. Woori Financial remained the most dependent on its banking operations. A simple calculation based on the difference between the group's consolidated net profit and Woori Bank's net profit puts the nonbanking share at approximately 9.7%, indicating that banking accounts for more than 90% of the group's earnings. Among Woori Financial's nonbanking subsidiaries, Woori Card generated cumulative net profit of 134 billion won, Tongyang Life Insurance earned 117 billion won and Woori Financial Capital posted 115 billion won. Against this backdrop, financial holding companies are accelerating efforts to expand their nonbanking businesses while maintaining the stable earnings base provided by their banks. Woori Financial has expanded its securities and insurance operations through the launch of Woori Investment & Securities and the acquisitions of Tongyang Life Insurance and ABL Life Insurance. Shinhan Financial has also recently decided to strengthen its insurance business through the acquisition of Lotte Insurance. onej@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092173149 https://it.chosun.com/news/articleView.html?idxno=2023092173149 Fri, 30 Oct 2026 12:00:00 +0900 fun3503@chosunbiz.com (Kim Kwang-yeon) Kim Jong-chul, Chairman of the Korea Communications Commission, is presiding over the 46th plenary meeting of 2026 held at the Government Complex Gwacheon on October 28. /News1 According to industry sources on the 29th, the Korea Communications Standards Commission (KCSC) imposed fines totaling 63.71 billion won on Google and Apple the previous day, charging 42.9 billion won for Google and 20.81 billion won for Apple, alleging that they violated the Telecommunications Business Act by effectively forcing app developers to use their own payment methods and restricting external payments. Earlier, in 2021, South Korea became the first country in the world to enact an amendment to the Telecommunications Business Act (the In-App Payment Mandate Ban Law) that prohibits app market operators such as Google and Apple from forcing specific payment methods. However, it took five years before the first fine was imposed. Although the government had already prepared the sanctions plan in 2023, the final implementation was delayed due to ongoing turmoil within the regulatory agencies, including the chairman’s resignation, impeachment, and dysfunction in the dual leadership system. In-app payments refer to a method in which users purchase and pay for digital goods or services within a smartphone app. It is mainly used to purchase game items, webtoon passes, and music or video subscription subscriptions. For example, if a game company sells a 10,000 won in-game item using Google Play's payment system, Google manages the payments and settlements. In return, the game company pays Google a contract-based fee. When the law banning forced in-app payments was enacted in Korea, Google and Apple allowed third-party payments using external payment gateways (PG) in addition to their own payment systems. Existing in-app payments were subject to a commission of up to 30%. However, even developers who chose third-party payment had to bear up to 26% in app market fees and separate payment agency fees. The structure made it difficult for developers to significantly reduce costs even if they changed their payment methods. The Korea Communications Standards Commission judged that Google and Apple infringed on developers' choice by allowing third-party payments while restricting other payment methods, such as external payments. The intention of the law to prevent the enforcement of specific payment methods has not been fully realized in the market. The problem is that this payment and fee structure was maintained even as government sanctions were delayed. Google and Apple continued to collect commission revenue from the domestic app market. However, when announcing the sanctions, the Korea Communications Commission did not disclose the total amount of commissions the two companies had earned domestically or how much economic gain they had obtained through illegal activities. However, by using the app market transaction figures released by the government, one can estimate the scale of fees generated in domestic app markets. According to the Korea Communications Commission's '2024 App Market Survey' released in April 2025, the transaction volume of domestic app markets in 2023 was 8.1952 trillion won. Google held a 67.5% market share, while Apple had 28.2%, with the two companies together accounting for 95.7% of the total market. Assuming the two companies’ market shares are based on transaction volume and applying an average commission rate of 20%, annual commission revenue is estimated at approximately 1.5686 trillion won. Applying a 30% commission rate, this amounts to approximately 2.3529 trillion won. However, the actual commission rates vary depending on the size of the developer, the subscription product, and the payment method. These figures are simple estimates based on app market transaction volumes and differ from actual commission revenue or profits obtained through illegal activities. The gaming industry also estimates that the commission burden is substantial. According to the Korea Game Industry Association, in-app payment commissions paid by domestic game companies to Google and Apple over four years from 2020 to 2023 are estimated at about 9 trillion won. It amounts to an average of 2.25 trillion won annually. Questions are also being raised about the effectiveness of these fines. The total fine imposed by the Korea Communications Standards Commission on Google and Apple amounts to 63.71 billion won. Meanwhile, the European Union (EU) imposed a total of 930 million euros (about 1.383 trillion won) in fines on the two companies over the past two years for violations related to app market payments and restrictions on external purchase channels. That amount is about 22 times that of South Korea. However, since the EU and South Korea differ in market size, applicable laws, and criteria for calculating fines, it is difficult to simply compare the severity of sanctions based on the amount alone. The task remains even after the fines are imposed. The Korea Communications Commission ordered Google and Apple to allow external payments and improve their fee structures, but did not set a specific cap on the fees. Even if the two companies allow external payments, it is uncertain how much the developers' actual cost burden will decrease if high fees are maintained. In March of this year, Google announced a revision to its payment policy, including the allowance of external payments and a reduction in service fees. Apple also explained its autonomous improvement direction for enhancing the app market transaction environment to the Korea-China Commission. However, further verification is needed to determine how much these policy changes will actually reduce the commission burden on domestic developers. A representative from the Korea Internet Corporations Committee explained, “Since Google and Apple effectively enforced their own in-app payments even after allowing third-party payments, if similar results emerge after allowing external payments, they could face sanctions.” The issue of developers receiving back the fees they had been paying has also remained unresolved. The Korea Communications Commission stated that there are legal provisions under the Telecommunications Business Act allowing it to claim damages over the issue of the return of commissions that Google and Apple have unfairly collected from app developers. This means that developers must seek compensation for damages through direct litigation. A representative from the Korea-America Economic Institute explained, “We took into account the parts of the facts that the parties must prove in current civil litigation.” Developers may need to prove, during the litigation process, that damages were caused by illegal acts of Google and Apple and to determine the extent of those damages. Even if the government acknowledges the illegal acts and imposes fines, it remains uncertain whether developers will be able to recover the commissions they have already paid. Legal circles are calling for a clearer revision of the Telecommunications Business Act to prevent Google and Apple from circumventing the law and to effectively protect developers from harm. An IT lawyer who requested anonymity said, “Even if Google and Apple were ordered to allow external payments this time, the current Telecommunications Business Act, which regulates in-app payments, is ambiguous, making it difficult to prove Google and Apple’s liability in future lawsuits,” adding, “The law should be amended to properly regulate in-app payments, third-party payments, and external payments alike.” fun3503@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092173007 https://it.chosun.com/news/articleView.html?idxno=2023092173007 Thu, 29 Oct 2026 14:30:23 +0900 jk2@chosunbiz.com (Jeong Jong-Kil) Andrew Shikiar, CEO of the FIDO Alliance, delivers a keynote address at Authenticate U.S. 2026 in Carlsbad, California / Photo by Jongkil Jeong. Authenticate is a digital identity and authentication conference organized by the FIDO Alliance, an international organization that develops online authentication standards. The seventh annual U.S. conference was held from October 19 to 21 under the theme “New Frontiers,” covering digital identity credentials and AI agent authentication alongside passkeys. During his keynote, Shikiar highlighted the growing adoption of passkeys, a passwordless authentication technology, while stressing that new security frameworks are needed as AI increasingly accesses services and conducts transactions on behalf of people. While traditional authentication has focused on preventing account takeovers and verifying legitimate users at login, future systems must also verify whether individual actions performed by AI agents have been authorized, he explained. AI Transactions Require Proof of Human Authorization For an AI agent to purchase products or conduct financial transactions on a user's behalf, it must be possible to verify that the agent has received authorization from the actual user and that the transaction falls within the permitted scope. Systems must also allow users to revoke delegated authority when necessary. Shikiar identified “Verified Human Identity” as a starting point for establishing such trust. The concept centers on the ability to verify that an AI agent's actions are grounded in the intentions of a real person. “Verified human identity does not mean that people have to disclose their identities to every service,” Shikiar explained. “Most services do not need to know exactly who a user is.” Instead, users should be able to prove that they are real people or meet specific eligibility requirements when necessary, without unnecessarily exposing personal information, he said. Shikiar also presented a hypothetical scenario set in 2030. A user asks an AI agent to find an apartment within a specified budget. The agent discovers an attractive property with a great view, but its price exceeds the authorized budget by 40%. In that situation, the AI agent cannot proceed with the application under its existing authority. It must obtain additional approval from the user. The example illustrates that delegating a task to AI does not give the agent unrestricted freedom to act. According to Shikiar, AI agents must respect the conditions established by users and disclose personal information only to the extent necessary for a transaction. The FIDO Alliance is developing specifications for AI agent payments to address these challenges. Building on technologies including Google's Agent Payments Protocol (AP2) and Mastercard's Verifiable Intent, the organization is working on methods to verify human-delegated authority throughout the transaction process. At the conference, the alliance said it was preparing to release a working draft of the relevant specifications. A view of the keynote session at Authenticate U.S. 2026 in Carlsbad, California. / Photo by Jongkil Jeong. More Than 7 Billion Passkeys in Use as FIDO Expands Into Digital Identity The new security challenges posed by AI agents have emerged as passkey adoption continues to expand. According to Shikiar, more than 7 billion passkeys are estimated to be in use worldwide. He said passkeys, which began gaining widespread adoption in 2022, have become a major authentication method for online services within four years. The FIDO Alliance's 2026 Passkey Index also highlighted this progress. Based on data from 15 major global service providers, the index found that more than one-third of successful sign-ins were completed using passkeys. Passkey authentication was also approximately three times faster than traditional login methods. However, while passkeys reduce the risks of password theft and phishing, they do not independently verify a user's real-world identity or the authority delegated to an AI agent. The FIDO Alliance is therefore identifying digital identity credentials as a major priority beyond passkeys. Digital identity credentials allow people to electronically prove information such as their identity, age, educational background or professional qualifications. Instead of providing unnecessary personal information to a service, users can demonstrate that they meet specific requirements while preserving their privacy. In enterprise environments, such credentials can support remote employee onboarding, identity verification and account recovery. Shikiar stressed that widespread adoption will depend on interoperability among identity issuers, digital wallet providers and identity verifiers, even when they operate different systems. To support this goal, the FIDO Alliance is developing common certification requirements for digital wallets. At the conference, the organization also outlined plans to publish working drafts for Verifier ID, a mechanism for establishing whether an entity requesting personal information is legitimate, and the Credential Manager Reference Architecture (CMRA), a technical framework supporting digital wallet authentication. The alliance also announced plans to establish an external advisory forum to involve governments, identity issuers and other stakeholders in standards development. Its first meeting was scheduled for November 2026. Shikiar pointed to the adoption of standardized shipping containers, which significantly improved efficiency in the global logistics industry, as an example of the value of common standards. He argued that open standards and interoperability will be equally important for digital identity and AI-driven transactions. If companies rely on incompatible authentication systems, AI agents will struggle to conduct secure transactions across multiple services. “This foundation of trust must be open, standardized and interoperable,” Shikiar said. He expressed hope that, by 2030, the industry would be able to look back on its current efforts as having helped build a safer, more convenient and more productive internet. jk2@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092173006 https://it.chosun.com/news/articleView.html?idxno=2023092173006 Thu, 29 Oct 2026 14:25:47 +0900 jk2@chosunbiz.com (Jeong Jong-Kil) Tanu Kaushik, Senior Manager of Identity and Security at eBay, speaks at Authenticate U.S. 2026 in Carlsbad, California. / Photo by Jongkil Jeong. Authenticate is a digital identity and authentication conference organized by the FIDO (Fast IDentity Online) Alliance, an international organization that develops online authentication standards. The seventh annual U.S. conference was held from October 19 to 21, covering topics including passkeys, digital identity credentials and artificial intelligence (AI) agent authentication. At the conference, eBay presented how it has transformed workplace authentication for employees worldwide. After establishing a board-level goal of eliminating password use, the company gradually expanded FIDO-based passkey authentication. Approximately 14,000 employees now use the technology in their daily work, representing about 80% of its workforce. The transition was driven largely by the threat of phishing attacks targeting passwords. Traditional passwords can be stolen when employees enter them into fraudulent login websites. Even MFA can be exploited through attacks in which repeated authentication prompts pressure users into approving a malicious request. FIDO-based passkeys, by contrast, authenticate users through cryptographic keys stored on their devices without requiring passwords. eBay configured its system to store authentication credentials in secure areas of company-managed devices, making them difficult to copy or extract. This approach helps reduce the risk of phishing-related account takeovers while easing the burden of password resets for employees and IT support teams. The challenge, however, was encouraging employees to adopt the new method. Initially, eBay offered traditional passwords alongside FIDO-based passkey authentication. The company subsequently made passkeys the default sign-in option, requiring additional steps for employees who wanted to continue using passwords. One particularly effective incentive was an exemption from periodic password changes for employees who accessed corporate systems exclusively through FIDO passkeys. This eliminated the inconvenience of resetting expired passwords or contacting the IT help desk for assistance. “Not having to change passwords periodically was a powerful incentive for employees,” Kaushik explained. “Rather than forcing adoption, we needed employees to feel that the new authentication method was easier, more convenient and offered greater benefits than the old one.” eBay also incorporated passkey enrollment into the initial setup process for new hires and employees receiving new work devices. To encourage broader adoption, the company shared weekly passkey adoption rates across executive-led organizations and promoted the initiative through emails and internal information screens. Making passkeys mandatory nevertheless presented challenges beyond technology. eBay had to address employee concerns about biometric data processing and review requirements related to European works councils and labor unions. The company also developed mechanisms to automatically revoke access privileges based on device security status or account risk. “Simply announcing a new authentication method is not enough to get employees to use it,” Kaushik said. “You need to understand the frustrations employees experience with existing methods and help them recognize tangible benefits, such as no longer having to change passwords.” She added that mandatory adoption could proceed only after the company had reviewed privacy and labor-related requirements and established systems to securely manage authentication credentials and devices. jk2@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092173009 https://it.chosun.com/news/articleView.html?idxno=2023092173009 Thu, 29 Oct 2026 14:22:57 +0900 jk2@chosunbiz.com (Jeong Jong-Kil) Sumanth Pinninti, Software Engineer at Tinder, speaks at Authenticate U.S. 2026 in Carlsbad, California. / Photo by Jongkil Jeong. Authenticate is a digital identity and authentication conference organized by the FIDO Alliance, an international organization that develops online authentication standards. The seventh annual U.S. conference was held from October 19 to 21, covering passkeys, digital identity credentials and AI agent authentication. Tinder, the global dating app operated by Match Group, has approximately 40 million monthly active users (MAUs) and processes around 1.75 billion swipes per day, as users select or skip other people's profiles. At the conference, Tinder presented its authentication strategy in a session titled “Balancing Security & UX: The Hidden Trade-offs in Modern Authentication.” Chhabra revealed that Tinder had recently identified accounts being created through Muse, Meta's personal AI agent. Muse can perform tasks on behalf of users, including browsing websites, making reservations and searching for information. Tinder's security team is currently blocking account creation through Muse. However, the company has not reached a final decision on how AI agents should be treated. “We are not yet certain whether AI agents are engaging in good or bad activities,” Chhabra explained. “We are continuing to evaluate whether they should be allowed to use the platform.” Tinder has long dealt with romance scams, spam, fraudulent profiles and account takeovers. One persistent problem involves users misrepresenting their identities, such as men creating profiles using women's photographs. The emergence of AI agents capable of creating accounts and interacting with the service on behalf of humans has made identifying genuine users even more complicated. One of Tinder's main countermeasures is Face Check, a facial verification technology that compares a video selfie taken by a new user with their profile photos to determine whether they are a real person and match the person shown in the profile. When suspicious activity is detected, Tinder can also use liveness detection to determine whether a real person is present in front of the camera. In November 2025, Tinder's parent company, Match Group, reported that security improvements, including facial verification, had reduced users' exposure to malicious profiles by 60%. According to Chhabra, Face Check has been deployed in more than 44 markets. Facial verification, however, is not foolproof. Chhabra described attempts by fraudulent users to bypass verification by placing matching facial images on objects such as mugs or in background pictures. Advances in deepfake technology and other image manipulation techniques have made it increasingly difficult to prevent fraud through facial verification alone. Another major challenge is strengthening security without creating unnecessary friction for legitimate users. Tinder experimented with blocking new account registrations through its website in certain countries because the web environment was particularly vulnerable to automated attacks. Although the experiment reduced malicious activity, it also negatively affected daily active users and revenue. The company subsequently reversed the policy and instead introduced facial verification into its web registration process. Tinder now takes a risk-based approach, adjusting the level of authentication required according to the likelihood of fraudulent activity. For low-risk users, the company evaluates device information and behavioral patterns in the background to minimize additional verification steps. When suspicious activity is detected, however, users may be required to complete additional checks, including facial verification. Manish Chhabra, Senior Product Manager at Tinder, speaks at Authenticate U.S. 2026 in Carlsbad, California. / Photo by Jongkil Jeong. Sumanth Pinninti, Software Engineer at Tinder, who also spoke during the session, identified account recovery as a particularly vulnerable part of authentication. “The weakest link in authentication is account recovery,” Pinninti said. To prevent attackers from exploiting account recovery methods such as email links and SMS verification codes, Tinder incorporates a range of behavioral signals into its risk assessments, including users' swiping patterns, conversations and previous enforcement actions. The company is also testing passkeys in one country. Passkeys allow users to sign in using cryptographic credentials stored on their devices instead of passwords. To reduce its dependence on SMS verification, Tinder is also considering a system in which users approve new login attempts through previously trusted devices. Over the longer term, Tinder plans to strengthen continuous authentication, a method that monitors user behavior even after initial registration and login and requests additional verification when necessary. For example, a user may be asked to verify their identity again after changing a profile photo or engaging in behavior associated with potential fraud. The goal is not only to establish that a real person created an account, but also to confirm that the same person continues to operate it. “What we want to verify is whether someone entering our platform is a real human being and whether they are the same person who provided the identity information,” Chhabra said. “Our goal is to provide a seamless experience for legitimate users while stopping malicious users at the registration and login stages.” jk2@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092173044 https://it.chosun.com/news/articleView.html?idxno=2023092173044 Thu, 29 Oct 2026 12:00:00 +0900 fun3503@chosunbiz.com (Kim Kwang-yeon) Lee Sang-joong, President of the Korea Internet & Security Agency, is responding to lawmakers' questions during a parliamentary audit of the National IT Industry Promotion Agency and others held on October 15 at the National Assembly's Science, Technology, Information and Broadcasting and Communications Committee in Yeouido, Seoul. /News1 According to industry sources on the 28th, President Lee Jae Myung gave final approval to the motion to dismiss Director Lee. This comes about two months after the KISA board of directors passed a motion for dismissal in August. A KISA official also answered “Yes” when asked whether Director Lee had been dismissed. Earlier, the KISA board of directors resolved to recommend the dismissal of Director Lee, judging that he had violated the duty of good faith as well as the obligations of compliance and integrity. The allegations surrounding Director Lee also became a point of contention during the recent National Assembly’s Science, Technology, Information and Broadcasting and Communications Committee’s audit. Lee Jeong-heon, a member of the Democratic Party, pointed out that although KISA press releases at the time of Director Lee’s appointment listed him as head of the Internet Crime Investigation Team at the Seoul Central District Prosecutors’ Office and director of the Cyber Investigation Office at the Supreme Prosecutors’ Office, these positions did not actually exist. Issues concerning the operation of institutions and budget execution were also raised. Lee claimed that Director Lee improperly handled the expenses by preparing documents to make it appear that the private residence he used during his business trip to Seoul was part of the employees’ shared housing. It was also revealed that there were cases where the budget was used contrary to its purpose, such as expensing the cost of dining alone as business promotion expenses. In response, Director Lee rebutted at the National Assembly audit, saying, “It is not a false entry on my resume,” and, “I actually performed such work, and at the time, I fully acknowledged that I was the head of the investigation team.” Regarding the audit findings on the use of corporate cards and other matters, “I will provide an explanation." He said, “There are also procedural issues regarding the audit.” To minimize a gap in operations caused by the director’s dismissal, KISA appointed Professor Ryu Jae-cheol of the Department of Computer Convergence at Chungnam National University, a non-executive director, as acting director. Acting President Ryu is scheduled to start official duties on the 29th. With KISA’s role becoming increasingly important due to a series of recent security incidents, the dismissal of its head is expected to further strain organizational management. KISA plans to stabilize its organization and address pressing issues under the acting leadership system. fun3503@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092173011 https://it.chosun.com/news/articleView.html?idxno=2023092173011 Thu, 29 Oct 2026 11:42:23 +0900 jk2@chosunbiz.com (Jeong Jong-Kil) Ian Glazer, Head of Continuous Identity Product Strategy at CrowdStrike / Courtesy of the FIDO Alliance. CrowdStrike is a U.S. cybersecurity company specializing in enterprise endpoint security, cyber threat detection and response, and identity-based attack protection. Glazer previously led identity and privacy research at Gartner and worked on identity product strategy at Salesforce. He also helped establish IDPro, a professional organization for digital identity specialists. “Today's attackers are no longer necessarily breaking into systems. Instead, they are using stolen credentials to enter through legitimate login processes,” Glazer said. He highlighted account recovery as a particularly problematic area. For services that people rarely use, forgotten passwords frequently turn account recovery into a routine alternative to logging in, creating additional opportunities for attackers. Glazer proposed “recognition” as an alternative. Rather than requiring users to prove their identity at every login, systems could continuously determine whether someone is a familiar, legitimate user by evaluating device information, behavioral characteristics and other signals. During the keynote, Glazer invited an attendee he had just met onto the stage to demonstrate how people can make trust judgments without formally checking someone's identity documents. Humans recognize familiar faces and draw on previous interactions, he explained, while computers repeatedly demand proof of identity even from users they have already encountered. “Today's behavioral security technologies are primarily used to detect when someone is not the usual user,” Glazer said. “We should develop technologies that can recognize when someone is the usual user.” He suggested that information available from operating systems, browsers and endpoint security platforms could make such a shift possible. If systems could continuously recognize legitimate users, repeated login procedures could be reduced. Additional authentication would be required only when the system detected that the person accessing a service might have changed. Unlike conventional approaches that maintain a login session for a fixed period, this model would continuously evaluate the level of trust associated with the user in real time. Ian Glazer delivers a keynote address at Authenticate U.S. 2026 in Carlsbad, California, on October 20, referencing Bob Blakley's “The Death of Authentication.” / Courtesy of the FIDO Alliance. The role of passkeys, which the FIDO Alliance has been promoting as a passwordless authentication method, would also change under this model. In normal circumstances, the system would recognize the user automatically. When recognition failed, a passkey could be used to verify the user's identity again, allowing the system to reestablish trust and continue recognizing legitimate activity. “The work we have put into expanding passkey adoption will not be wasted,” Glazer said. “Passkeys will become a powerful tool for helping systems recognize users again.” However, privacy protection and technical reliability remain major challenges. Continuous recognition requires information about users' devices and behavior. Glazer described this approach as a form of “participatory surveillance.” He emphasized that users must voluntarily consent to such monitoring and that, wherever possible, information should be processed locally on their devices, with raw data discarded afterward. Current technology also has limitations that prevent recognition from reliably replacing conventional logins. If users interact with a service only briefly, the system may not have enough behavioral information to establish their identity with sufficient confidence. Glazer acknowledged that recognition technology has not yet reached the level of reliability required to consistently replace traditional authentication. His presentation was therefore a proposal for the future direction of authentication technology rather than a demonstration of a fully commercialized replacement for login systems. Authenticate U.S. 2026 brought together speakers from major global technology companies including Google, Microsoft, Amazon, Meta and OpenAI; financial and payment institutions such as Visa, Mastercard and JPMorgan Chase; and cybersecurity companies including CrowdStrike, Palo Alto Networks and Okta. Approximately 1,000 specialists involved in developing and deploying authentication technologies gathered to discuss current challenges and future directions. Against this backdrop, Glazer's keynote challenged the industry's longstanding assumption that users must repeatedly authenticate themselves to access digital services. “The next challenge is making recognition reliable enough that it can serve as the starting point for a new session,” Glazer said. “Traditional authentication should become the emergency exit we use when necessary, rather than the front door we pass through every day.” Authenticate is a digital identity and authentication conference organized by the FIDO Alliance, an international organization that develops online authentication standards. The seventh annual U.S. conference was held from October 19 to 21, covering passkeys, digital identity credentials and artificial intelligence (AI) agent authentication under the theme “New Frontiers.” jk2@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092173003 https://it.chosun.com/news/articleView.html?idxno=2023092173003 Thu, 29 Oct 2026 11:20:28 +0900 jk2@chosunbiz.com (Jeong Jong-Kil) Quendoline Jansen, Product Designer at Spotify / Photo by Jongkil Jeong, Carlsbad, California. Authenticate is a digital identity and authentication conference organized by the FIDO Alliance, an international organization that develops online authentication standards. The seventh annual U.S. conference was held from October 19 to 21 under the theme “New Frontiers,” covering passkeys, digital identity credentials and artificial intelligence (AI) agent authentication. During a morning session on the opening day, Spotify presented its login and account recovery strategies for a global audience of more than 750 million monthly active users (MAUs). Jansen and Laura de Bella, Engineering Manager at Spotify, shared how the company has adapted its authentication systems as the service has grown. When Spotify launched in 2006, it designed its authentication system primarily around email addresses and passwords for desktop users in Europe. As its audience expanded worldwide and the range of connected devices grew, however, the limitations of that approach became apparent. In some markets, people relied more heavily on phone numbers than email addresses. Others struggled to recover their accounts because they no longer had access to the email addresses they had originally registered. In response, Spotify introduced phone numbers as a primary authentication method in 23 markets worldwide. It also diversified its login options to reflect local preferences, including Naver login in South Korea. “In the early days, we assumed email was a universal login method that everyone used. But as we expanded globally, we learned that users in different countries were familiar with different authentication methods,” Jansen explained. “Naver login, which we introduced in South Korea, quickly became the third most widely used login method in that market,” she added. Simplifying Login Did Not Always Improve User Retention Spotify also revised its earlier assumption that simpler login and registration processes would necessarily produce better business results. The company had previously focused on reducing the number of steps users had to complete. However, an experiment that eliminated certain onboarding steps, including those designed to identify users' interests, actually resulted in lower user retention. Laura de Bella, Engineering Manager at Spotify /Photo by Jongkil Jeong, Carlsbad, California. “For a long time, we believed that reducing friction would help us grow. But removing steps does not necessarily mean users will stay with the service longer,” de Bella said. “Sometimes, keeping certain steps helps improve the user experience later on.” “We now evaluate both the costs and benefits of each step,” she added. Spotify also reported business gains from its response to users who violated its service rules. The company blocked modified versions of its app that allowed users to access paid Premium features for free, reducing the number of users of those apps by 81%. Rather than simply excluding those users, Spotify encouraged them to return to its official service. As a result, it converted 2 million users into paying subscribers and another 5.4 million into legitimate users of its free service, according to the company. “Not everyone who breaks the rules is a malicious attacker,” Jansen said. “Some are music fans who could become legitimate subscribers in the future.” She emphasized that understanding users' intentions is important, even when they have committed the same type of violation. Drawing on these experiences, Spotify now evaluates authentication policies using a broader set of measures, including login success rates and speed, new user acquisition, user retention and fraud risks. The company conducts phased experiments across different markets and user groups to assess how changes to authentication affect both security and business performance. “We cannot judge everything by a single metric such as authentication success rate,” de Bella said. “One authentication method may be faster but carry security risks, while another may take longer but offer stronger protection.” “The success of an authentication policy also needs to be tied to business objectives such as acquiring and retaining users,” she added. Diversifying Authentication Across More Than 2,000 Device Types Spotify plans to reduce its reliance on passwords over the long term. The company currently supports email-based one-time passwords (OTPs), phone numbers and third-party sign-in options such as Google and Apple. It is also preparing to introduce passkeys, which allow users to sign in without passwords. However, Spotify supports more than 2,000 types of devices, ranging from smartphones and televisions to cars, gaming consoles and smart speakers. This makes it difficult to manage every login environment with a single authentication method. “Passkeys are excellent in terms of both security and user experience, but they cannot solve every problem for a service like Spotify, which needs to support such a wide variety of devices and user environments,” de Bella said. “Passkeys are part of our long-term strategy to reduce dependence on passwords. We plan to make the transition gradually while continuing to support existing authentication methods,” she added. Jansen stressed that Spotify's global scale requires flexibility rather than a one-size-fits-all approach. “There is no single right answer that works for 750 million users,” she said. “The most appropriate authentication method depends on the country, the user and the business objective.” “We need to keep testing the assumptions we have taken for granted. If changing an earlier decision can deliver a better user experience, it is worth doing,” she added. jk2@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092173015 https://it.chosun.com/news/articleView.html?idxno=2023092173015 Thu, 29 Oct 2026 11:17:01 +0900 jk2@chosunbiz.com (Jeong Jong-Kil) Jean-Pierre Pralle, Product Manager at Google, speaks at Authenticate U.S. 2026 in Carlsbad, California. / Photo by Jongkil Jeong. Jean-Pierre Pralle, Product Manager at Google, outlined the technology and its implementation plans during Authenticate U.S. 2026, a conference organized by the FIDO Alliance in Carlsbad, California, on October 21 (local time). The feature, called Zero-Tap Sign-In Restoration, automatically restores an app's previous sign-in state when users transfer their data to a new smartphone. The requirement applies not only to apps that require users to sign in, but also to those that offer login as an optional feature. It covers smartphones and tablets, while games are currently excluded. Google first introduced its Restore Credentials technology in November 2024. In 2025, Uber implemented the technology in its app and evaluated its effectiveness over a five-week period. Based on the test results, Uber estimated that deploying the feature across its entire user base could eliminate approximately 4 million repeat logins annually. Following such trials, Google announced in August 2026 that it would make support for automatic sign-in restoration mandatory for applicable Google Play apps. The core of the technology is the Restore Credentials feature. When users sign in to an app on their existing smartphone, the app generates a separate authentication credential called a Restore Key. This key is transferred along with other data when the user moves to a new device. The app on the new device then uses the Restore Key to authenticate with its server and restore the user's existing login session. As a result, users can open the app on their new smartphone without having to enter a password or receive a verification code. Restore Keys do not contain users' existing passwords. Instead, the technology uses public-key cryptography similar to that employed by passkeys, allowing servers to verify that users are authorized to access their accounts. Passkeys are a passwordless authentication technology based on pairs of public and private cryptographic keys. Pralle described the Restore Key as a type of “invisible passkey” that users do not have to manage themselves. However, apps are not required to support passkeys as a login method to implement automatic restoration. The technology can also be used by apps that rely on passwords or federated sign-in methods such as Google account login. According to Google, the change has security benefits as well as convenience advantages. Reducing the need to reenter passwords or receive verification codes when switching smartphones can also reduce opportunities for phishing attacks and credential theft. To back up Restore Keys to the cloud, users must be signed in to their Google accounts, have Android backup enabled and have a screen lock configured on their devices. However, automatic restoration does not mean that all apps will eliminate additional authentication during device transfers. The current technology supports only one account per app. If a user has multiple accounts within the same app, such as personal and work accounts, only one can be restored automatically. Apps must also delete their Restore Keys when users sign out on their existing devices. Apps subject to strict security regulations, including those in the financial and healthcare sectors, may request exemptions from Google Play's mandatory implementation requirement. Even when automatic restoration is supported, individual services may still require additional identity verification under their own security policies. Google will also recognize certain existing automatic restoration implementations if they meet the new requirements. Apps that fail to comply with the technical quality requirements, however, may face restrictions on publishing or visibility on Google Play. “Users have a hard time remembering whether they signed in to each app with a passkey, a password or another linked account,” Pralle said. “And they shouldn't have to.” Google plans to continue improving the sign-in restoration experience so that users can access their existing services on new devices without having to worry about which authentication method they previously used. jk2@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092173016 https://it.chosun.com/news/articleView.html?idxno=2023092173016 Thu, 29 Oct 2026 11:05:44 +0900 jk2@chosunbiz.com (Jeong Jong-Kil) Bill Chen (left), Product Manager for Digital Identity at Google, and Claire Forszt, Product Manager for Authentication and Account Recovery at Google, present the company's projected account recovery methods for 2035: digital IDs at 50%, phone numbers at 20%, selfie verification at 15%, recovery codes at 10% and security keys at 5%. / Photo by Jongkil Jeong, Carlsbad, California. Authenticate is a digital identity and authentication conference organized by the FIDO Alliance, an international organization that develops online authentication standards. “We expect digital IDs to become widely adopted around the world by 2030 and potentially emerge as a primary account recovery method across the industry,” Forszt said. “By combining passkeys with strong account recovery technologies, we want to create an environment where users can securely access their accounts whenever they need to.” For 2035, Google also projected that phone numbers would account for 20% of account recovery methods, followed by selfie verification at 15%, recovery codes at 10% and security keys at 5%. Google's efforts to develop new account recovery methods come amid the growing adoption of passkeys. Passkeys are a passwordless authentication technology that uses a pair of cryptographic keys: a public key registered with an online service and a private key stored on the user's device or in a credential manager. Users authorize the use of their private keys through biometric authentication or a device PIN. Because the cryptographic keys are bound to the domain of the registered service, passkeys provide strong resistance to phishing attacks. The challenge arises when users lose the only device through which they can access their accounts. If no passkey is available on another device and no alternative authentication method has been configured, users may have to rely on less secure recovery methods, such as passwords or SMS verification codes. “If weak account recovery procedures remain in place, the security benefits of passkeys can effectively be undermined,” Forszt warned. Chen highlighted the limitations of phone-based verification. “An SMS verification code only proves that someone has possession of a particular phone number. It does not prove how that person obtained the number,” he explained. Claire Forszt (left), Product Manager for Authentication and Account Recovery at Google, and Bill Chen, Product Manager for Digital Identity at Google, at Authenticate U.S. 2026 in Carlsbad, California. / Photo by Jongkil Jeong. Google's proposed solution is to use digital identity credentials for account recovery. Under this approach, a trusted institution, such as a government agency or financial institution, verifies a person's identity and issues a digitally signed identity credential that can subsequently be used to recover an account. This differs from simply photographing a physical identity document and storing the image. A mobile driver's license (mDL) is one example of a digital identity credential. Such credentials can be stored in a smartphone's digital wallet, with their authenticity verified through the issuing authority's digital signature. Users may also selectively disclose only the information necessary for identity verification. Google proposed a system in which users register a digital identity credential as an account recovery method in advance. During registration, the credential would be verified within a secure execution environment that restricts external access. The system would then generate a unique cryptographic identifier and associate it with the user's account. If users lose their smartphones, they could obtain a new digital identity credential on another device after completing identity verification with the issuing authority. During account recovery, the system would generate a new identifier and compare it with the previously registered value to determine whether the credentials belong to the same person. This would allow account providers to verify a user's identity without directly accessing or storing original personal information such as names or identity document numbers. Google specifically proposed applying the technology to credential managers that store passkeys for multiple services. If users could recover their credential manager accounts using digital identity credentials, they would regain access to the passkeys stored within those accounts. This approach could also reduce the burden on individual service providers, which would otherwise need to build their own digital ID-based recovery systems. Several challenges remain before the technology can be widely deployed. Users would need to be able to obtain replacement digital identity credentials quickly, even after losing their original smartphones. Some existing issuance processes require reviews that can take hours or days. Technical interoperability would also need to be established among digital wallets, operating systems, credential issuers and credential managers. Given these unresolved issues, Google expects traditional recovery methods, including phone numbers and recovery codes, to remain available alongside digital identity credentials for the foreseeable future. “Governments and industry need to work together to establish trust in digital identity credentials and create an environment where users can use them securely,” Chen said. Photo: Claire Forszt (left), Product Manager for Authentication and Account Recovery at Google, and Bill Chen, Product Manager for Digital Identity at Google, at Authenticate U.S. 2026 in Carlsbad, California. Photo by Jongkil Jeong. jk2@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092173017 https://it.chosun.com/news/articleView.html?idxno=2023092173017 Thu, 29 Oct 2026 07:28:19 +0900 jk2@chosunbiz.com (Jeong Jong-Kil) Andrew Shikiar, CEO of the FIDO Alliance, at Authenticate U.S. 2026 in Carlsbad, California. / Photo by Jongkil Jeong. The three-day event, held from October 19 to 21 under the theme “New Frontiers,” explored the growing adoption of passkeys and developments in digital identity, payments and AI agent authentication. The final day's program featured presentations by Mastercard and the FIDO Alliance, followed by a panel discussion involving representatives from Visa, PayPal and other payment industry organizations. “Passkeys have shown what this industry can achieve when we align on a common vision, standards, certification and a consistent user experience,” said Andrew Shikiar, CEO of the FIDO Alliance. “Now we need to do the same for digital credentials.” Mastercard Highlights Passkey Success, New Authentication Needs for AI Purchases Jonathan Grossar, Senior Vice President at Mastercard, said passkeys are improving both security and convenience in online payments. According to Mastercard, authentication completion rates among consumers who have already enrolled payment passkeys exceed 95%. Jonathan Grossar, Senior Vice President at Mastercard, at Authenticate U.S. 2026 in Carlsbad, California. / Photo by Jongkil Jeong. By allowing customers to approve payments using fingerprint or facial authentication, much like unlocking a smartphone, passkeys reduce the inconvenience of entering passwords or switching to banking apps. Mastercard also presented Digital Payment Credentials (DPC) as a next step in payment authentication. Under the proposed approach, payment credentials issued by banks or other institutions would be stored in smartphone wallets. Consumers could review transaction details, including the amount and merchant, before approving payments through biometric authentication. Mastercard was testing related prototypes, while some features remained under development as part of ongoing standardization efforts. Authentication requirements become more complex when AI agents purchase products on behalf of consumers. Grossar described a scenario in which a consumer instructs an AI agent to purchase a T-shirt from a particular brand for less than $100. If the agent later finds a suitable product and completes the purchase, the payment system must be able to verify that the transaction was authorized, even though the consumer is not present at checkout. To address this challenge, Grossar introduced Verifiable Intent, a technology designed to connect a user's identity, purchase instructions and the actions subsequently taken by an AI agent. “We now need to prove not only that a transaction was authorized, but also that what the agent did was consistent with what the user intended,” Grossar said. Mastercard is working with the FIDO Alliance on related standardization efforts. EMVCo, a technical standards organization involving major international payment networks including Visa and Mastercard, is also developing common specifications for AI-driven payments. FIDO Alliance: “Trust Is Not a Feature, It Is an Outcome” Nishant Kaushik, Chief Technology Officer (CTO) of the FIDO Alliance, warned that technically secure authentication does not necessarily guarantee a trustworthy service. “Trust is not a feature. It is an outcome,” Kaushik said. Nishant Kaushik, CTO of the FIDO Alliance, at Authenticate U.S. 2026 in Carlsbad, California. / Photo by Jongkil Jeong. He explained that even when passkeys or digital wallets function correctly, users may still experience unfavorable outcomes. One example is an AI agent that authenticates successfully but takes actions the user did not intend or authorize. Kaushik also highlighted new risks that can emerge as authentication becomes easier. Passkeys have made it possible to combine secure login with a convenient user experience. However, easier identity verification could encourage businesses to request personal information more frequently and in situations where it may not be necessary. If users must disclose personal information to access essential services or avoid unfavorable conditions, their ability to provide meaningful consent may be limited. Kaushik argued that technical standards alone cannot resolve these challenges. Digital identity systems must also accommodate people with disabilities and users of older devices, while establishing clear accountability when incidents occur. He said digital identity infrastructure should become widely accessible, much like roads or telecommunications networks, emphasizing the need for cooperation among governments, businesses and standards organizations. Kaushik also urged the industry to evaluate authentication technologies by their real-world outcomes rather than adoption figures alone. “The measures should be whether actual fraud has decreased, whether users can access services more easily and whether unnecessary sharing of personal information has been reduced,” he said. Visa, PayPal and EMVCo Debate Responsibility for AI-Driven Purchases A panel discussion moderated by Dave Birch, a digital payments expert and co-founder of Consult Hyperion, examined the challenges that arise when AI agents make purchases on behalf of consumers. From left, Dave Birch, co-founder of Consult Hyperion; Gavin Shenker, Senior Director at Visa; Rakan Khalid, Senior Director at PayPal; and Arman Aygen, Senior Technical Director at EMVCo, during a panel discussion at Authenticate U.S. 2026 in Carlsbad, California. / Photo by Jongkil Jeong. Representatives from Visa and PayPal said AI agent transactions had begun to emerge, although transaction volumes remained relatively small. They nevertheless agreed that rapid technological development was creating an urgent need to define authorization boundaries and responsibility for transactions. Gavin Shenker, Senior Director at Visa, illustrated the problem with an example involving an AI agent instructed to purchase shoes. A consumer might specify a preferred color and price, but allowing the AI agent to accept nonrefundable purchase conditions raises a different question. Shenker said the industry needs ways for consumers to understand and approve relevant purchase terms without having to read lengthy terms and conditions for every transaction. Another challenge is determining how much personal information should be shared during AI-assisted purchases. Shenker noted that if a consumer asks an AI agent to organize a birthday party, a merchant selling birthday candles or a payment provider does not need to know the consumer's entire party plan. Payment systems should be able to verify that transactions have been properly authorized while disclosing only the information required by each participant. EMVCo is also examining technical frameworks for maintaining consistent authorization conditions throughout the purchasing process, from the consumer's initial instructions to final payment. Rakan Khalid, Senior Director at PayPal, emphasized buyer protection and responsibility for transaction disputes. If an AI agent purchases the wrong product or completes a payment the consumer did not authorize, existing refund and dispute resolution systems will need clear rules for evaluating what happened. Khalid said consumers, merchants and payment providers must be able to establish their respective responsibilities when an AI agent is involved in a transaction. Arman Aygen, Senior Technical Director at EMVCo, argued that AI payment standards should not focus solely on the final payment stage. Authorization conditions must be managed throughout the purchasing process, beginning when users instruct AI agents to search for and select products. He emphasized that cooperation among companies and standards organizations would be essential to establishing consistent technical requirements. Andrew Hindle, Chair of the Authenticate conference, at Authenticate U.S. 2026 in Carlsbad, California. / Photo by Jongkil Jeong. Following the public conference, the FIDO Alliance held a two-day Member Plenary on October 22 and 23 to continue technical and standardization discussions involving passkeys, digital credentials and AI agent payments. The meetings provided an opportunity for member companies and technical working groups to build on the issues raised during the three-day conference. In his closing remarks, Andrew Hindle, Chair of the Authenticate conference, highlighted the expanding scope of authentication technologies and the FIDO Alliance's work. “The scope of authentication is changing, and so is the scope of what FIDO addresses,” Hindle said. “To make the progress the industry needs, we need more people to get involved.” jk2@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092173019 https://it.chosun.com/news/articleView.html?idxno=2023092173019 Wed, 28 Oct 2026 18:48:01 +0900 jdh@chosunbiz.com (Jeon Dae-hyeon) The country’s four listed non-life insurers—Samsung Fire & Marine Insurance, DB Insurance, Hyundai Marine & Fire Insurance and Hanwha General Insurance—are forecast to post combined third-quarter net profit of 1.1943 trillion won, according to consensus estimates compiled by financial data provider FnGuide on Oct. 28. That would represent a 39% decline from 1.957 trillion won in the preceding quarter. Samsung Fire & Marine is expected to earn 524 billion won, followed by DB Insurance at 361.4 billion won, Hyundai Marine & Fire at 215.7 billion won and Hanwha General Insurance at 93.2 billion won. Samsung’s figures are on a consolidated basis, while those of the other three insurers are on a standalone basis. Actual earnings could fall short even of those estimates. iM Securities projects combined third-quarter net profit of 1.062 trillion won for the four insurers, about 11% below consensus. The brokerage expects Samsung Fire & Marine to report 467 billion won, DB Insurance 320 billion won and Hyundai Marine & Fire 184 billion won, missing market expectations by 11% to 15%. Hanwha General Insurance is the only company expected to broadly meet expectations, with projected net profit of 92 billion won. Insurers had initially expected two policy changes to improve earnings: bringing manual therapy under a regulated benefit category within the national health insurance system, and introducing an “eight-week rule” for auto insurance claimants with minor injuries. Both measures aim to curb excessive treatment and reduce insurers’ claims costs. Since July, the price of manual therapy, which previously varied widely across providers, has been fixed at 43,850 won per session. Treatment requirements have also been tightened, with patients required to undergo basic physical therapy before receiving manual therapy. Insurers have repeatedly incurred losses when actual claims exceeded their assumptions, partly because charges for treatments outside national health insurance coverage were difficult to predict without limits on prices or treatment frequency. The four insurers’ combined shortfall from claims exceeding expectations is forecast to narrow to 77.5 billion won in the third quarter, from 334.1 billion won a year earlier—an improvement of more than 250 billion won. Auto insurance rules have also been tightened for patients seeking prolonged treatment for minor injuries. Since Sept. 10, the Ministry of Land, Infrastructure and Transport has required patients with sprains, bruises and other minor injuries to submit medical documentation and undergo a separate review if they seek treatment beyond eight weeks after an accident. The measure came too late to materially improve third-quarter results. The four insurers are expected to post a combined auto insurance loss of 2 billion won for the quarter. The impact of the eight-week rule is unlikely to become visible until November, with a more substantial improvement in profitability expected next year. The biggest drag on earnings, however, is weak investment performance. iM Securities estimates that the four insurers’ combined third-quarter investment income fell 61.9% from a year earlier to 280.8 billion won. A sharp stock market correction beginning in July was a major factor. After exceeding 9,000 in June, the benchmark Kospi briefly fell into the 5,000 range in July. It subsequently fluctuated in the mid-to-upper 6,000s before ending the quarter in the 6,800 range. The volatility is estimated to have generated valuation and disposal losses across equities, structured bonds, alternative investments and bond funds. Industry observers expect the pressure to persist into the fourth quarter. The Kospi slipped back into the 5,000 range this month, making a recovery in investment income more difficult. Year-end revisions to claims assumptions pose another risk. Insurers reassess their expected future claims ratios at the end of each year. Assumptions for simplified-underwriting policies, often purchased by people with pre-existing medical conditions, could become more conservative. Higher assumed claims ratios reduce the future profits recognized on insurers’ books. As a result, relatively few insurers are expected to pay year-end dividends. Brokerages identify Samsung Fire & Marine and DB Insurance among non-life insurers, and Samsung Life Insurance among life insurers, as likely dividend payers this year. “Higher interest rates are improving yields on new investments, which should strengthen recurring earnings over the medium to long term,” said Seol Yong-jin, an analyst at iM Securities. “In the near term, however, weak investment income will inevitably leave earnings below market expectations.” jdh@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092172928 https://it.chosun.com/news/articleView.html?idxno=2023092172928 Wed, 28 Oct 2026 12:00:00 +0900 fun3503@chosunbiz.com (Kim Kwang-yeon) Smart Choice communication unclaimed refund inquiry page screen. / Screenshot from the Korea Telecommunications Operators Association (KTOA) Smart Choice website According to data submitted to Democratic Party lawmaker Han Jun-ho by the Korea Communications Commission on the 27th, the unclaimed balance of the three major telecom companies as of June this year was 3.06 billion won. By company, SK Telecom had the highest amount at 1.44 billion won, followed by LG Uplus at 1 billion won and KT at 620 million won. The unclaimed balance in 2019 was also 3.86 billion won, remaining in the 3 billion won range even after seven years. Unclaimed telecom refunds are money that subscribers have not received after canceling their service or switching to another carrier. This includes overpaid amounts, deposits, or prepaid funds that were not refunded after cancellation due to the service termination date differing from the billing or payment date. For example, if a subscriber who switched from KT to SK Telecom was found to have paid an additional 5,000 won during the billing process, the 5,000 won that KT should refund is considered an unclaimed balance. The Korea Telecommunications Operators Association (KTOA) currently operates a service on the Smart Choice website for checking unclaimed telecom refunds. Users can check their unclaimed refunds and apply for a refund by entering their name, resident registration number, and the respective telecom provider. Telecom providers are also informing customers of the unclaimed refunds via text messages and mail. However, inquiries do not often lead to actual refund applications. From 2022 to June of this year, a total of 2,149,745 unclaimed refunds were reported, but only 15,963 refund applications were filed. The number of applications is about 0.7% of the number of views. Telecom providers are also notifying customers of the refunds via text message. The number of shipments reached hundreds of thousands each year: 729,286 in 2023, 613,692 in 2024, and 670,000 in 2025. However, the unclaimed balance still remains in the 3 billion won range. The problem is that even if the carrier notifies users of the unclaimed refund, the actual refund largely depends on the user's application. Users who are not familiar with digital devices, such as the elderly, may find it difficult to make inquiries and apply on their own even with guidance. If the unclaimed amount is small, you may overlook the need to apply. This issue has been raised for a long time. In the 2018 National Assembly, there were calls to require that refund accounts be registered in advance when subscribing to telecommunications services. The issue of unclaimed refunds continued to recur, but it did not lead to any significant improvement. The same issue was raised again during this year’s National Assembly audit. Telecom companies say they are working to provide refunds, but there are practical limitations. A representative from a telecom company explained, “We are trying to contact them both online and offline, but sometimes we simply cannot reach them,” adding, “Due to privacy concerns with the current system, we have no choice but to keep sending messages to the contacts the company already has.” However, as the same issue has been recurring over a long period, there are criticisms that the existing guidance method has its limitations. Ahn Jeong-sang, adjunct professor at Chung-Ang University's Graduate School of Communication, said, “This issue has been repeatedly raised in the National Assembly every year, but telecom companies are not paying much attention to it,” adding, “If the money is meant for customers, it should be provided through an automatic refund system as part of telecom welfare.” The Korea Mission to the United States also plans to recognize the limitations of the current refund method and discuss ways to improve it. A representative from the Korea Communications Commission said, “Direct inquiries and applications are currently possible through Smart Choice and other platforms, but we are aware of the shortage in refund applications,” adding, “We will discuss the issue of unclaimed refunds with telecom companies in the consultative body.” fun3503@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092172938 https://it.chosun.com/news/articleView.html?idxno=2023092172938 Wed, 28 Oct 2026 10:16:07 +0900 jubar@chosunbiz.com (Byun In-ho) Connecting an AI shopping assistant to external shopping platforms can expand consumer choice, but it may reduce a platform’s existing transaction revenue. / Image generated by ChatGPT Platforms that operate their own shopping businesses must also consider how recommending products sold elsewhere could affect existing transactions. If they recommend only products from sellers on their own platforms, comparisons with external shopping platforms are limited. If they also recommend external products, consumers have more choices, but purchases that would otherwise have taken place on the platform could move to competitors. Expanding the range of recommendations may benefit consumers without necessarily benefiting platform revenue. Whether external shopping platforms participate is another variable. Having AI find and compare products across multiple platforms is different from connecting users to purchasing and payment functions. The parties must separately coordinate whether the AI can access product information, whether purchasing functions can be integrated and who bears the costs when a transaction occurs. In particular, shopping platforms with their own customers and seller networks need a reason to provide product and transaction information to an external AI service and pay fees on top of that. Meta, too, is at a stage where it must turn Muse’s growing adoption into revenue. At its earnings announcement on Oct. 21, local time, Meta disclosed usage figures for Muse and identified service expansion, monetization and improved computing efficiency as tasks ahead. Naver and Kakao are expanding their AI agents from different starting points. Naver is focusing on using data from its own services, including shopping and place-related data. Kakao is focusing on expanding partnerships with external businesses. As a result, the two companies could differ in how they secure products and services to recommend, as well as in how they share revenue. Naver operates an AI shopping agent based on Naver Plus Store. Kakao is preparing Kanana Space, which performs tasks in KakaoTalk in response to user requests. Kakao plans to expand its functions to include ordering, gifting, reservations and money transfers. To earn fees by connecting users to external transactions, an AI agent must demonstrate that it contributes to additional sales or lower costs. From a shopping platform’s perspective, there is little incentive to partner if the AI merely changes the route of a purchase that would have occurred anyway while adding a fee. On the other hand, there is room to share revenue if the AI attracts new customers, increases purchase conversion rates or reduces marketing costs. “To secure transaction fees through AI agents, companies must provide tangible benefits to external businesses,” said Kim Dae-jong, a professor in the Department of Business Administration at Sejong University. “Companies like Amazon that have their own platforms and customer data have little incentive to pay fees to Meta.” He added, “To collect fees through an AI agent, it must use AI to increase consumers’ purchase conversion rates and reduce companies’ marketing costs.” Platforms that operate their own shopping businesses must also consider the gains and losses associated with recommending external products. If a purchase that would have taken place on their platform moves to another shopping platform, sellers on the platform could lose sales opportunities, and the platform could lose the revenue it would have earned from that transaction. However, if external recommendations increase service usage and generate new transactions or partnership revenue, those gains could offset the losses. In other words, revenue from new transactions and partnerships must exceed the losses caused by existing transactions moving elsewhere. Limiting recommendations to products within a platform also has drawbacks. Even if the AI selects a suitable product from within the platform, it does not establish whether the price and purchasing conditions are better than those offered by external shopping platforms. Consumers may need to use another service or search on their own to find better terms. “Even if AI makes product searches more convenient, consumers may struggle to obtain enough information to compare prices if the product information available on each platform is limited,” said Lee Jang-seok, a professor in the Department of Media and Communication at Gachon University. “Even the lowest price recommended by AI may be limited to products sold on that particular platform.” He added, “Just as users must subscribe separately to different streaming services to watch each platform’s original content, consumers may have to use multiple AI agents or conduct additional searches themselves if product information is divided among platforms.” jubar@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092172844 https://it.chosun.com/news/articleView.html?idxno=2023092172844 Tue, 27 Oct 2026 12:00:00 +0900 fun3503@chosunbiz.com (Kim Kwang-yeon) Deputy Prime Minister and Minister of Science and ICT Bae Kyounghun is responding to lawmakers' questions during a parliamentary audit of the Ministry of Science and ICT and others held on October 6 at the National Assembly's Science, Technology, Information and Broadcasting and Communications Committee in Yeouido, Seoul. /News1 According to the security industry on the 26th, the newly discovered vulnerability is highly dangerous because hackers can execute malicious commands on a web server without using an ID or password. If successful, it can install a malicious file called a webshell that remotely controls the server to extract customer information or paralyze the website. In response, the PHP development team released a security update on October 21 (local time). The European Union’s cybersecurity agency (CERT-EU) and cybersecurity bodies in major countries such as the United Kingdom, the Netherlands, and Germany also rated the vulnerability as critical and recommended an immediate update. Systems that were difficult to update were disconnected from the internet or temporarily shut down. In the Netherlands, Germany, France, and other countries, government agencies and companies have proactively suspended the operation of their websites. The European Patent Office (EPO), the Internet Corporation for Assigned Names and Numbers (ICANN), and ETH Zurich also blocked access to some services. In contrast, the response at home has been somewhat lukewarm. The Ministry of Science and ICT, after a crisis assessment meeting with the Korea Internet & Security Agency (KISA), issued a caution cyber crisis alert for the private sector starting at noon on the 22nd, but has not announced a detailed inter-agency response plan. Cyber crisis alerts in the private sector are divided into four levels: ‘Attention→’ ‘Caution→’ ‘Warning→’ and ‘Severe.’ The problem is that domestic websites are at a relatively higher risk of being exposed to PHP vulnerabilities. According to the global web technology research firm W3Techs, the proportion of PHP usage on websites using Korean servers was 82.6%, higher than the global average of about 69%. A survey by the French security firm CybelAngel also found that 82% of PHP servers in Korea had ended security support, the second highest in the world after Algeria (100%). A security industry official said, “The problem is that many older versions of PHP are still in use domestically,” adding, “There is also a possibility of fake attacks where malicious files are uploaded to the internet and disguised as test code.” Another official assessed, “Most financial institutions have already implemented the update, so it appears that no major incidents have occurred yet,” but added, “The possibility of the vulnerability being exploited still remains.” Both ruling and opposition parties criticized the Ministry of Science and ICT for its passive response during this year's audit. People Power Party lawmaker Seo Cheon-ho criticized, “The response is too slow, and the government’s view of the recent cyberterrorism is far too complacent.” Democratic Party lawmaker Han Jun-ho also criticized, saying, “What matters is not whether an alert was issued, but how quickly the vulnerable public system was actually identified and protected.” Deputy Prime Minister and Minister of Science and ICT Bae Kyounghun stated that he would review the preparation of a comprehensive inter-ministerial plan and organizational restructuring. Experts warned that the response should not be delayed on the grounds that no large-scale damage has yet been confirmed in the country. Lee Ki-hyuk, a professor in the Department of Convergence Security at Chung-Ang University and president of the Korea Institute of Security Policy, pointed out, “It is not that Korean sites are safe; rather, the response has likely been relatively slow, or the damage may not have been widely exposed to the public, which makes them very dangerous.” fun3503@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092172751 https://it.chosun.com/news/articleView.html?idxno=2023092172751 Mon, 26 Oct 2026 12:00:00 +0900 fun3503@chosunbiz.com (Kim Kwang-yeon) On October 6, Deputy Prime Minister and Minister of Science and ICT Bae Kyounghun responded to lawmakers' questions during a parliamentary audit of the Ministry of Science and ICT held at the National Assembly's Science, Technology, Information and Broadcasting and Communications Committee in Yeouido, Seoul. /News1 According to the Broadcasting and Media Communication Commission’s ‘Broadcast Media Usage Behavior Survey’ released on the 24th, OTT usage rates rose 46.8 percentage points from 35.0% in 2016 to 81.8% in 2025. The usage rate of Generative AI also rose by 11.2 percentage points to 44.5% this year. Mobile carriers are also rapidly expanding bundled products that combine OTT and Generative AI services. KT’s mobile OTT bundled products expanded from three types in 2020 to 14 types this year. They also operate four AI-linked products. LG Uplus expanded its product lineup from three Netflix bundle plans to 12 OTT bundle plans and 6 AI bundle plans. SK Telecom is also offering pricing plan benefits for major OTT services and Google AI Pro and Plus. OTT subscription fees are also rising. The monthly subscription fee for YouTube Premium on web and Android platforms rose 71.5%, from 8,690 won in 2019 to 14,900 won this year. Netflix Premium pricing plan also rose 17.2%, from 14,500 won to 17,000 won in November 2021. However, it is necessary to separately verify how much these price increases have increased overall household spending on digital services. The government’s household communication cost policy is focused on lowering mobile phone charges. To reduce household communication costs, the Ministry of Science and ICT introduced 5G pricing plan in the 20,000 won range and a Data Safety Option (QoS) this year. Measures to reduce communication costs, including promoting budget phones and encouraging competition in device subsidies, were also announced. In contrast, OTT and Generative AI subscriptions were not included among the main targets of the existing communication fee reduction policy. The government operates a communication fee reduction program to ease the communication cost burden for vulnerable groups, including people with disabilities, low-income individuals, and basic pension recipients. However, the reduction applies only to communication line charges. OTT and Generative AI subscriptions are not included among the supported services. Civic groups argue that the system should be improved to fit the changed digital service environment. Han Seok-hyun, head of the Seoul YMCA’s Citizen Mediation Office, said, “The share of fixed costs for OTT and Generative AI subscriptions has increased,” adding, “It is now time to consider including OTT and generative AI in household communication expense policies.” Voices calling for institutional reform also emerged in the National Assembly during this year’s audit. Lee Hoon-ki, a member of the Democratic Party, demanded, “The Ministry of Science and ICT, as the main agency in charge of communications, must develop measures to ease the burden of communication costs for citizens in the OTT and AI era by considering the costs of mobile communications, OTT, and AI,” and called for “plans to reduce communication expenses that the public can actually feel.” Lee Jeong-heon, a member of the Democratic Party, stated, “We must guarantee not only the right to be connected to communications but also the right to use digital services, including AI,” adding, “The welfare system should be reformed so that users can choose the support they need and the government and digital ecosystem providers share responsibility.” fun3503@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092172764 https://it.chosun.com/news/articleView.html?idxno=2023092172764 Mon, 26 Oct 2026 11:15:11 +0900 jubar@chosunbiz.com (Byun In-ho) Workforce reductions are sweeping through the OTT industry. / AI-generated image by ChatGPT According to industry reports compiled on October, Netflix and Disney have implemented or announced layoffs affecting more than 2,000 employees this year. The job cuts come amid intensifying competition for viewers' attention in the video market. According to market research firm Nielsen, YouTube accounted for 14.2% of total television viewing time in the United States in July. Its share rose to 15.8% in August, setting a new all-time high. YouTube's influence is expanding even on television screens, where paid streaming services and traditional broadcasters have traditionally competed. Netflix informed employees on October 14 (local time) that it would cut approximately 1,000 jobs, representing about 6% of its workforce. The layoffs primarily target product, technology, legal and human resources divisions. Co-Chief Executive Officers Ted Sarandos and Greg Peters explained that the company needed to make rigorous decisions about where to prioritize personnel and resources to support business growth. The layoffs are not the result of deteriorating financial performance. Netflix reported third-quarter revenue of $12.874 billion (approximately 17.05 trillion won), up 11.8% from a year earlier. However, its revenue growth rate was the lowest in approximately three years. The company is therefore reassessing how it allocates personnel and resources as revenue continues to rise but growth slows. Disney has reduced its workforce in three rounds this year. In April, the company laid off approximately 1,000 employees across marketing, film and television production, ESPN and other divisions. It made additional cuts of several hundred employees in both July and September. Reports also emerged this month that Disney was considering further layoffs affecting hundreds of employees as part of a television division restructuring involving Hulu Originals and other units. In an August shareholder letter, Disney executives said the company was reviewing ways to reduce labor costs and selling, general and administrative expenses to free up resources for investment in growth areas. Further layoffs are also expected as a result of mergers and acquisitions. Paramount Skydance completed its acquisition of Warner Bros. Discovery (WBD) on October 6 (local time) and renamed the combined company Skydance. The transaction brought two global streaming services, Paramount+ and HBO Max, under the same corporate umbrella. Skydance informed employees that the integration process would involve difficult decisions affecting its workforce. The company plans to generate more than $6 billion (approximately 7.96 trillion won) in annual synergies within three years by reducing expenses in technology, procurement, marketing and other operations. Industry observers expect streaming companies to continue strengthening cost controls. "OTT companies have accumulated significant losses through competition in content production, prompting them to scale back production and focus on managing costs," said an industry expert who requested anonymity. "As reduced content production also limits revenue growth, and competition continues with short-form video platforms such as YouTube, Instagram and TikTok, this emphasis on cost management is likely to intensify." In South Korea, Watcha began restructuring in 2022, including a voluntary retirement program, amid financial difficulties. As its business struggles continued, the company entered court-supervised rehabilitation proceedings in August 2025. The situation is different for Tving and Wavve, which are pursuing a merger. Industry observers believe that the companies must first determine whether the merger will proceed before addressing employment succession or workforce restructuring, as they are currently at a stage of corporate integration involving executives holding concurrent positions. If the merger is completed, existing employment relationships will, in principle, transfer to the surviving or newly established company. Tving reportedly retained the employment of existing workers when it absorbed KT's streaming service Seezn in 2022. Kim Jun-young, a certified labor attorney at Seowoo Labor Law Firm, explained that under the principle of universal succession in a merger, existing employment relationships and working conditions must generally be maintained. jubar@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092172747 https://it.chosun.com/news/articleView.html?idxno=2023092172747 Sun, 25 Oct 2026 22:35:38 +0900 sjyoon@chosunbiz.com (Yoon Seung-jun) / News1 According to the Korea Exchange on October 21, a total of 14 companies affiliated with major conglomerates have pursued duplicate listings on South Korea’s stock market since 2020. Of these, eight were listed following carve-out spin-offs, while six involved the listings of subsidiaries or second-tier subsidiaries. Among these cases, seven parent companies saw their share prices decline following their subsidiaries’ listings. LG Chem stands out as a prime example of the shareholder losses associated with duplicate listings. In September 2020, LG Chem spun off its battery business into a wholly owned subsidiary, LG Energy Solution, which subsequently went public on the Korea Composite Stock Price Index (KOSPI) market in January 2022. The move triggered what is widely known as the “double-listing discount,” in which the parent company’s shares trade at a reduced valuation following the listing of its subsidiary. LG Chem’s share price, which had climbed to KRW 1.05 million in early 2021, began declining as LG Energy Solution’s IPO approached. By the day before the subsidiary’s market debut, LG Chem shares had fallen to KRW 664,000. Shareholders who had invested in LG Chem to benefit from the growth potential of its battery business were left bearing losses without receiving a single share in the newly listed company. The valuation discount on the parent company persists to this day. LG Chem’s 79.4% stake in LG Energy Solution is valued at approximately KRW 80.2 trillion, yet LG Chem’s own market capitalization stands at just KRW 19.4 trillion, less than one-quarter of the value of its subsidiary stake. Its price-to-book ratio (PBR), which once exceeded 4 times, has also shrunk to just 0.6 times. SK Group has likewise faced controversy over duplicate listings. Between 2020 and 2021, the conglomerate brought three subsidiaries created through carve-out spin-offs to the stock market in less than a year. These included SK Biopharmaceuticals, established after SK Inc. spun off its life sciences division; SK Bioscience, formed through the separation of SK Chemicals’ vaccine business; and SK IE Technology (SKIET), a separator manufacturer spun off from SK Innovation’s materials business. SK Bioscience and SKIET attracted KRW 63.62 trillion and KRW 80.9 trillion, respectively, in subscription deposits during their IPOs, consecutively breaking records at the time. However, the performance of their parent companies told a different story. SK Chemicals shares declined for six consecutive trading sessions following its subsidiary’s listing, while SK Innovation shares fell for three straight sessions. Their current share prices remain 79.1% and 46.1% below their respective levels immediately before the subsidiaries went public. SK Inc. experienced a similar downturn. Its share price declined for seven consecutive trading sessions immediately after SK Biopharmaceuticals went public. By the end of that year, SK Inc. shares had fallen approximately 20% compared with the day before its subsidiary’s listing. Other notable cases include HD Hyundai Heavy Industries, spun off from HD Korea Shipbuilding & Offshore Engineering and listed in September 2021; Kakao Pay, spun off from Kakao and listed in November 2021; LS Materials, spun off from LS Corp. and listed in December 2023; and HD Hyundai Marine Solution, spun off from HD Hyundai and listed in May 2024. These companies also represent cases in which key business operations were separated and subsequently listed on the stock market. Image generated by ChatGPT Even without carve-out spin-offs, there have been numerous cases in which parent companies suffered valuation discounts after separately listing their previously unlisted subsidiaries. Kakao listed Kakao Games, which was established through a series of mergers and acquisitions, including the merger with Daum Games, and KakaoBank, a digital bank established in 2016. Kakao Games was subsequently sold in June 2026. However, the results for Kakao shareholders have been devastating. Kakao’s share price has plunged 78.8%, from KRW 149,000 on the day before KakaoBank’s IPO to its current level of KRW 32,100. It is also 59.1% lower than its level immediately before Kakao Games went public. Other examples of duplicate subsidiary listings include Doosan Robotics under Doosan Corp., LG CNS under LG Corp., K Bank under KT, and Model Solution under Hankook Tire & Technology. As shareholder losses continued to mount, financial regulators moved to strengthen the regulatory framework. In September 2022, authorities introduced measures requiring companies pursuing carve-out spin-offs to disclose the purpose of the spin-off, potential listing plans, and measures to protect shareholders. In December of the same year, the Enforcement Decree of the Financial Investment Services and Capital Markets Act was amended to grant appraisal rights to shareholders opposing such spin-offs, allowing them to demand that the company purchase their shares. Starting in August 2026, the scope of regulation was expanded beyond carve-out spin-offs to include acquired and newly established subsidiaries. Under the revised framework, duplicate listings are prohibited in principle and permitted only as exceptions when certain requirements are met. The controversy has now extended to overseas stock markets. A prominent example is Solidigm, a second-tier subsidiary of SK hynix that is reportedly pursuing a U.S. listing. Established in 2021 following SK hynix’s acquisition of Intel’s NAND flash memory and solid-state drive (SSD) businesses, Solidigm is reportedly targeting an IPO as early as 2027. If the listing proceeds, it would create a four-tier structure of publicly traded companies, comprising SK Inc., SK Square, SK hynix, and Solidigm. Including AI Company, an unlisted entity that serves as Solidigm’s direct parent company, the ownership structure would extend across five corporate tiers. The Korea Corporate Governance Forum criticized the proposal as “an unprecedented attempt at a five-tier multiple listing structure” and called for discussions on the IPO to be halted. SK hynix, meanwhile, stated that it is “reviewing various options to strengthen Solidigm’s competitiveness, but no decisions have been finalized.” Financial authorities have also signaled their intention to respond. During a parliamentary audit of the National Policy Committee on October 19, Lee Chan-jin, governor of the Financial Supervisory Service (FSS), said, “We believe the proposed listing falls under the category of duplicate listings, and we will take all appropriate measures within our authority.” However, when asked whether Solidigm would be required to submit a securities registration statement in South Korea, Lee said, “We are awaiting an authoritative legal interpretation from the Financial Services Commission (FSC).” His remarks suggest that even if regulators determine the proposed IPO constitutes a duplicate listing, the legal grounds for blocking it remain unclear. Market observers believe the handling of Solidigm’s proposed listing could set an important precedent. Other subsidiaries of major Korean conglomerates considering overseas IPOs, such as Hyundai Motor Group’s Boston Dynamics and Kakao’s Kakao Mobility, could potentially follow a similar path. Lee Nam-woo, chairman of the Korea Corporate Governance Forum, criticized the SK hynix board for failing to proactively assess the potential impact of the proposed listing on shareholders. “Under the amended Commercial Act, boards of directors have a duty to protect the rights and interests of ordinary shareholders. The SK hynix board’s failure to proactively examine the potential harm to shareholders from the listing amounts to a dereliction of duty,” Lee said. “If there are concerns that the listing could infringe upon shareholder rights, the board must immediately review the matter, decide to halt the listing, and publicly disclose its decision,” he added. sjyoon@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092172627 https://it.chosun.com/news/articleView.html?idxno=2023092172627 Fri, 23 Oct 2026 12:00:00 +0900 fun3503@chosunbiz.com (Kim Kwang-yeon) Financial Supervisory Service Governor Lee Chan-jin and the heads of the five major banks are listening to lawmakers' questions during a National Assembly audit of the Financial Supervisory Service and others held at the National Assembly's Political Affairs Committee in Yeouido, Seoul, on October 19. Back row, from left: Kang Tae-young, President of NH Nonghyup Bank; Lee Ho-sung, President of Hana Bank; Jung Jin-wan, President of Woori Bank; Sanghyuk Jung, President of Shinhan Bank; Lee Hwan-joo, President of KB Kookmin Bank. / News1 According to data submitted to Lee Jeong-heon, a member of the National Assembly’s Science, Technology, Information and Broadcasting and Communications Committee from the Democratic Party, by the Financial Supervisory Service and the Financial Services Commission on the 22nd, financial authorities conducted emergency security self-inspections of about 290 financial companies and electronic financial service providers to prevent recurrence of the Lotte Card incident in October 2025. This differs from the intent of the ‘Comprehensive Inter-Ministerial Information Security Measures’ announced by the government last October. At the time, the National Security Office, along with the Financial Services Commission, Ministry of Science and ICT, Personal Information Protection Commission, National Intelligence Service, and Ministry of the Interior and Safety, announced plans to conduct a comprehensive security vulnerability inspection of 1,650 IT systems in the financial, telecommunications, and public sectors used by the majority of the population. However, the financial authorities required financial companies to identify security vulnerabilities themselves and report the results. The problem is that personal information breach incidents occurred consecutively this year at KB Kookmin Bank and Shinhan Bank, which had reported that there were no security vulnerabilities at the time. At Shinhan Bank, the names, phone numbers, addresses, and encrypted resident registration numbers of 25,729 customers were leaked between September 28 and 30 of this year. At KB Kookmin Bank, the employee mobile work system was also hacked on September 30, resulting in the leak of the names, phone numbers, and addresses of 119 customers. At the National Assembly’s Political Affairs Committee audit this October, it was also revealed that Shinhan Bank took 15 hours and 26 minutes to recognize the breach after it occurred. At KB Kookmin Bank, there were even allegations that an internal executive ordered the deletion of access logs following the hacking incident. Similar cases occurred not only in the financial sector but also in other industries. In October last year, the Ministry of Science and ICT entrusted 831 companies and institutions with conducting self-assessments of their security. At that time, a personal information leak occurred this year at Musinsa and Weverse Company (a HYBE subsidiary), which had replied that the inspection was complete. Suspicious signs of an incident were also found at S-Oil Total Energies Lubricants and SSG.com, which had reported that their inspections were completed at the same time. Although it had not yet been confirmed whether personal information had been leaked, the two companies detected suspicious activity and reported the incident to the Korea Internet & Security Agency (KISA) in September. Rep. Lee Jeong-heon urged, “Personal data breach incidents have occurred consecutively at banks that reported no security vulnerabilities in their self-assessments by financial authorities,” adding, “Instead of simply trusting the results of these self-assessments, the financial authorities must establish a system to objectively verify the actual level of security.” The lawmaker added, “Since the financial sector handles the public’s sensitive personal and financial information, the effectiveness of security inspections is paramount,” emphasizing, “Authorities must thoroughly review whether vulnerabilities were properly identified during last year’s inspections and whether any areas requiring improvement were overlooked, and strengthen post-inspection verification, management, and supervision to prevent repeated superficial self-inspections.” Lee Ki-hyuk, president of the Korea Institute of Security Policy and professor in the Department of Convergence Security at Chung-Ang University, said, “If we compare a security check to a health examination, it is usually conducted with a focus on basic screening. “Full manual inspections are physically impossible due to the time and cost involved,” he said. “The IT environment is like a living organism, constantly changing through server expansions and version upgrades. It was assessed that the financial authorities and banks may have failed to detect the vulnerability. fun3503@chosunbiz.com ]]> https://it.chosun.com/news/articleView.html?idxno=2023092172528 https://it.chosun.com/news/articleView.html?idxno=2023092172528 Thu, 22 Oct 2026 12:00:00 +0900 fun3503@chosunbiz.com (Kim Kwang-yeon) Financial Supervisory Service Governor Lee Chan-jin and the heads of the five major banks are listening to lawmakers' questions during a National Assembly audit of the Financial Supervisory Service and others held at the National Assembly's Political Affairs Committee in Yeouido, Seoul, on October 19. Back row, from left: Kang Tae-young, President of NH Nonghyup Bank; Lee Ho-sung, President of Hana Bank; Jung Jin-wan, President of Woori Bank; Sanghyuk Jung, President of Shinhan Bank; Lee Hwan-joo, President of KB Kookmin Bank. / News1 According to industry sources on the 22nd, among the companies that suffered hacking incidents in September and October this year, only the online investment-linked finance firm PFCT Technologies (PFCT) announced a plan to pay in cash. PFCT plans to pay 20,000 won each to the 302 individuals whose personal information was leaked by November. Other companies mainly offered rewards for using their own services. Shinhan Bank, which lost the personal information of approximately 25,000 people, decided to purchase financial crime damage compensation insurance at the bank's expense for all affected customers. Shinhan Bank also plans to offer VIP-level services, including waivers of various fees and preferential exchange rates. Hana Bank plans to upgrade the status of all 89 customers whose personal information was leaked to VIP. VIP customers receive various fee waivers and other benefits. Gangnam Unnie, whose personal information of 220,000 people was leaked, decided to provide domestic victims with company points worth 50,000 won. Gangnam Unnie also provides them with insurance against financial fraud for one year. Hollys, whose personal data of 2.76 million customers was leaked, and Musinsa, whose data of 160,000 people was leaked, have yet to present compensation plans. Within the industry, these compensation plans are being criticized for focusing more on retaining customers than on compensating victims. This is because the victim must continue using the company that leaked their personal information to receive compensation. The fee waivers and preferential exchange rates offered by companies are available only by using their services. The use of in-house points is also restricted. This is presumed to be the result of companies referring to Coupang’s compensation plan last year. In December last year, Coupang offered a purchase voucher worth 50,000 won per customer as compensation for personal data breaches. The pass could be used for 5,000 won each on Coupang and Coupang Eats. The remaining 40,000 won was split so that 20,000 won was spent on Coupang Travel and 20,000 won on the luxury service Alux. The Coupang subscription was valid for three months. Even if customers paid less than the ticket price, they were not able to get their remaining balance back. Customers who had withdrawn had to re-register to use their passes. This is why Coupang has been criticized for using compensation as a pretext to encourage additional purchases and service reuse. Tving, whose 39.54 million user accounts were hacked, has set similar conditions. Among the Tving rewards, the only benefit that specified an amount was 5,000 points. The victim found it difficult to purchase a single latest movie using only these points. During this year’s National Assembly audit, Democratic Party lawmaker Kim Hyun-jung pointed out, “With only points worth 5,000 won, you can’t watch the latest titles, so victims end up having to pay out of pocket, making it a typical ‘bait product.’” Rep. Kim criticized, “Granting the merged platform Wavve and its affiliate CGV coupons to favor its own users is nothing more than internal promotion disguised as consumer protection.” Some analysts argue that the current system for reducing fines under the Personal Information Protection Act is merely the background to these compensation measures. Under current law, the Personal Information Protection Commission can reduce fines by up to 30% if the company that suffered from the hacking takes corrective action. Kim Ju-ho, head of the Civil Economy Team at People’s Solidarity for Participatory Democracy, said, “Companies are offering so-called compensation plans to reduce the Personal Information Protection Commission’s fine amounts, but these do not actually benefit consumers,” adding, “The Commission needs to carefully review the contents of companies’ compensation proposals and reflect them as mitigating factors.” Gwak Do-seong, Policy Director of the Citizens’ Coalition for Consumer Sovereignty, said, “Even claiming damages for personal data breaches is not enough, yet companies’ compensation levels remain inadequate. He said, “The points offered by Tving and others for in-house use are hardly a fair compensation plan,” adding, “We need to introduce class-action systems and other measures to increase consumer utility.” fun3503@chosunbiz.com ]]>