South Korea is investigating hundreds of financial institutions after more than 470,000 data records were leaked from 37 firms over the past month, according to the country’s financial regulator.

The Financial Services Commission (FSC) revealed the scale of the breaches on Thursday as authorities vowed to strengthen cybersecurity measures following a string of similar cases affecting the financial sector and government agencies.

The FSC detailed the incidents at a meeting with officials from financial trade associations and government agencies to review data protection systems and the capabilities of artificial intelligence in the financial sector, Yonhap News reported.

Following the confirmation of the first data leak on September 30, a total of 40 data leak incidents were reported at 37 companies, the FSC noted. These include four commercial banks, five financial investment firms, three insurance firms and five savings banks.

Additionally, the FSC disclosed that an estimated 1 billion won (US$745,000) in funds held by smaller brokers, insurers and small-scale online financial businesses were stolen, but customers’ money remained intact. Sensitive personal information that could be used for illegal financial transactions, including customers’ names, national identification numbers, bank account numbers or account passwords, was not in the leaked data.

The FSC said it would conduct comprehensive inspections at roughly 580 companies, covering traditional financial institutions, electronic finance companies and the virtual asset industry, local media SBS News reported.

The inspections will review internal control operations, decision-making procedures in managing external touchpoints and responsibilities of top management staff, including chief executive officers, chief information security officers and chief information officers at financial institutions.

Seoul aims to complete the inspection of internal control systems by the end of this year, according to SBS News.

“We will not tolerate practices that cause incidents or exacerbate damage by ignoring known security risks, neglecting even basic management duties or relying on perfunctory inspections and complacent responses,” FSC chairman Lee Eog-weon said in the meeting.

South Korea has been hit with a series of data leaks. In June, passport details of 168 people, including President Lee Jae Myung, first lady Kim Hea-hyung, senior aides and bodyguards, were posted on a cybersecurity website. Leaked data included names in Korean and English, job titles, passport numbers, dates of birth and passport issuance and expiry dates, local media The Korea Herald reported.

On Tuesday, Lee called for the establishment of a central cybersecurity agency to coordinate responses across government bodies against cyberattacks.

Lee said cyberattacks posed a threat to the economy and national security. He added that AI was making cyberattacks more sophisticated and widespread, exposing the limitations of the current system, which relied on routine inspection and post-breach responses.

Analysts said Lee’s proposal for a new government-wide agency might not be enough to tackle the problem if complacency remained in businesses and government agencies.

Park Dong-chul, a professor specialising in security issues at Chung-Ang University, said: “Many companies in this country still regard cybersecurity as little more than a costly nuisance until they suffer a serious security breach. Many of them still resort to reactive, piecemeal measures to contain the damage after an incident occurs.”

Park said that the government also needed to raise awareness of the importance of cybersecurity to change the widespread perception that investments in cybersecurity were “throwing money out of the window.”