Cyber risk gains ground in Korean financial firms' credit ratings

Korea Ratings is considering more objective ways to measure financial firms’ exposure to cyber threats as cyberattacks increasingly affect credit risk. The agency says attacks can disrupt operations, weaken profitability and financial health, and raise funding costs. Korea Ratings lowered Lotte Card’s risk management score in March after a breach affecting about 2.97 million customers. Since Oct. 1, seven Korean financial firms have reported data leaks affecting more than 67,000 people.

Korea Ratings said cyber risk can weaken a financial institution’s business prospects and financial health, citing operational disruptions and internal-control weaknesses.

S&P Global Ratings lowered Bank of Valletta’s rating to BBB- from BBB in 2019 after a cyberattack affected operations and governance.

Korea Ratings already incorporates cyber risk through its risk management assessment and other environmental, social and governance factors.

The seven firms reporting leaks since Oct. 1 included Shinhan Bank, KB Kookmin Bank, Hana Bank, Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital.

Published Oct 11, 2026 4:19 pm KST

Updated Oct 11, 2026 5:42 pm KST

"AI Cybersecurity" is seen behind a keyboard in this illustration, Sept. 23. Reuters-Yonhap

Cyberattacks are becoming a more consequential credit risk for financial firms, as the damage can extend beyond data theft to operational disruptions and higher funding costs. Korea Ratings is considering more objective ways to measure firms’ exposure to cyber threats, industry officials said Sunday.

In a recent report, the ratings agency said cyber risk can weaken both a financial institution’s business prospects and its financial health. International rating agencies have already downgraded companies after cyberattacks disrupted operations or exposed weaknesses in internal controls.

In 2019, S&P Global Ratings cut Bank of Valletta’s rating to BBB- from BBB following a cyberattack, citing operational risks and governance weaknesses that hurt its creditworthiness.

Korea Ratings has also recently incorporated cyber-related concerns into its assessment of a domestic financial firm. In March, it lowered Lotte Card’s score for the “risk management” factor in its regular credit assessment. Lotte Card disclosed a data breach in August last year that exposed information belonging to about 2.97 million customers.

The recent spate of breaches across Korea’s financial sector has brought the issue into sharper focus.

Since Oct. 1, seven financial firms have reported data leaks affecting more than 67,000 people. They include the country’s three largest commercial lenders — Shinhan Bank, KB Kookmin Bank and Hana Bank — as well as Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital.

Korea Ratings already factors cyber risk into its assessments, including through adjustments to the “risk management” component and among other environmental, social and governance factors. It is now looking at ways to supplement those qualitative judgments with more objective measures of firms’ exposure to cyber risk.

“Cyber risk has evolved into a multifaceted credit risk that can simultaneously weaken profitability, cash flow, liquidity and capital adequacy while increasing regulatory costs, damaging reputation and raising funding costs. We believe its importance to creditworthiness has also grown,” Kim Jung-hyun, a credit specialist at Korea Ratings, wrote in the report.

随着网络攻击对信用风险的影响日益加剧，韩国评级机构正在考虑采用更客观的方法来衡量金融机构面临的网络威胁风险。该机构表示，网络攻击会扰乱运营、削弱盈利能力和财务状况，并增加融资成本。今年3月，在乐天信用卡发生影响约297万客户的数据泄露事件后，韩国评级机构下调了乐天信用卡的风险管理评分。自10月1日以来，已有7家韩国金融机构报告了数据泄露事件，影响超过6.7万人。

韩国评级机构表示，网络风险会削弱金融机构的业务前景和财务状况，并指出其会导致运营中断和内部控制薄弱。

2019 年，由于网络攻击影响了瓦莱塔银行的运营和治理，标普全球评级将该银行的评级从 BBB 下调至 BBB-。

韩国评级机构已将网络风险纳入其风险管理评估以及其他环境、社会和治理因素中。

自 10 月 1 日以来报告泄密事件的七家公司包括新韩银行、KB 国民银行、韩亚银行、釜山银行、Yegaram 储蓄银行、Welcome 储蓄银行和现代资本。

发布于2026年10月11日下午4:19（韩国标准时间）

更新于2026年10月11日下午5:42（韩国标准时间）

这张插图（9月23日）显示，“人工智能网络安全”字样出现在键盘后面。（路透社-韩联社）

网络攻击正日益成为金融机构面临的重大信用风险，因为其造成的损失不仅限于数据窃取，还包括运营中断和融资成本上升。业内人士周日表示，韩国评级机构正在考虑采用更客观的方法来衡量企业面临的网络威胁风险。

该评级机构在最近的一份报告中指出，网络风险会削弱金融机构的业务前景和财务状况。此前，一些国际评级机构已因网络攻击导致公司运营中断或暴露内部控制漏洞而下调了其评级。

2019 年，标普全球评级在瓦莱塔银行遭受网络攻击后，将其评级从 BBB 下调至 BBB-，理由是运营风险和治理缺陷损害了其信用度。

韩国评级机构近期也将网络安全方面的担忧纳入了对一家韩国国内金融公司的评估。今年3月，该机构下调了乐天信用卡在常规信用评估中的“风险管理”评分。乐天信用卡去年8月披露了一起数据泄露事件，约297万客户的信息遭到泄露。

近期韩国金融领域发生的一系列安全漏洞事件，使这个问题更加引人注目。

自10月1日以来，已有7家金融公司报告数据泄露事件，影响超过67000人。其中包括韩国三大商业银行——新韩银行、KB国民银行和韩亚银行——以及釜山银行、Yegaram储蓄银行、Welcome储蓄银行和现代资本。

韩国评级机构已将网络风险纳入其评估考量，包括调整“风险管理”要素以及其他环境、社会和治理因素。目前，该机构正在探索如何以更客观的指标来补充这些定性判断，从而更准确地衡量企业面临的网络风险敞口。

韩国评级机构的信用专家金正铉在报告中写道：“网络风险已演变为一种多方面的信用风险，它会同时削弱盈利能力、现金流、流动性和资本充足率，同时增加监管成本、损害声誉并提高融资成本。我们认为，它对信用评级的重要性也日益凸显。”