[Edaily Reporter An Yu-ri ] Amid a series of personal information leaks, financial authorities issued a “Caution” consumer alert targeting the general public on the 6th. The alert urges the public to be on guard against secondary damage, such as voice phishing or smishing, resulting from the use of leaked personal information.

Kim Hyuk-jun, CEO of Naru Security, stated, “What AI hacking reveals is combined information from a business perspective that was not readily apparent in existing vulnerability lists,” adding, “When a single piece of data becomes the key to the next query, the combination of information creates a path for attack.”

Security experts advise users to start by reviewing basic security settings, such as passwords and authentication methods. Based on advice from security experts, financial authorities, and the Korea Internet & Security Agency (KISA), we have compiled the “10 Security Commandments” that users should know.

“Use Different Passwords for Google and Naver Email Accounts Used for Authentication”

The first thing to do is ① to use different passwords for each service. Using the same password across multiple services means that information leaked from one service could lead to the compromise of other accounts. It’s also best to avoid simply changing a few numbers or symbols in an existing password.

In particular, email accounts should be managed separately with a unique password. Email is often used to reset passwords or verify identity for other services. If your email account is compromised, there is a high likelihood that your other accounts will be exposed as well.

② It is also important to set up multi-factor authentication (two-step verification) when logging in. By adding an authentication app or one-time passwords (OTPs), you can reduce the risk of account compromise even if your password is compromised, as an additional verification step is required.

Conversely, ③ you should never approve login authentication requests that you did not initiate yourself. You must also never share your authentication numbers or codes with anyone else.

It’s also essential to make a habit of regularly checking your account status. ④ You should periodically review your recent login history and the list of devices used to access your account. If you notice an unfamiliar device or receive a notification about a password change you didn’t request, you should suspect that your account has been compromised.

⑤ Frequently using the “Sign Out of All Devices” feature is also helpful. You should also verify that your account recovery email, phone number, and two-factor authentication methods have not been changed to different information.

Beware of “Targeted Scams” That Exploit Fears of Data Breaches

Immediately following a personal data breach, you must also be wary of phishing and smishing attempts that exploit the incident. ⑥ In particular, you should never assume a contact is legitimate simply because they claim to know your personal information. Scammers may exploit your anxiety by citing “confirmation of a data breach,” “compensation claims,” or “account protection,” or they may mention details such as your income, credit limit, or occupation to pose as a legitimate financial institution.

⑦ Do not immediately click on links included in text messages or emails. Financial authorities and financial institutions do not send web addresses or request passwords and verification codes via phone or text message under the pretext of notifying you about a personal information leak or offering compensation for damages. You must verify whether your personal information has been leaked or check loan information directly through the financial institution’s official website, app, or customer service hotline.

Account information stored on your device can also be a target for attack. ⑧ Do not use the password-saving or auto-login features in your web browser on public computers. Be sure to log out after finishing your session on a public computer.

⑨Keep your operating system (OS), web browser, and antivirus software up to date. Malware designed to steal information can also extract passwords or login credentials stored in your browser. If you suspect a malware infection, scan your device with security software and change the passwords for your key accounts using a secure device.

Try the “Financial Transaction Safety Block” and “Dark Web Search Service”

⑩ By signing up for the financial sector’s “Financial Transaction Safety Blocking Service,” you can prevent unauthorized credit loans, credit card loans, remote account openings, and open banking transactions from being conducted in your name. If you register your personal information exposure with the “Personal Information Exposure Incident Prevention System” on “Fine,” the Financial Consumer Information Portal of the Financial Supervisory Service, restrictions will also be placed on opening new accounts and issuing credit cards.

If you’re worried that your leaked information might be circulating on the dark web, you can also use a search service. The Personal Information Protection Commission and the Korea Internet & Security Agency (KISA) operate the “Find My Leaked Information Service.” You can easily check for leaks online or via a mobile app.

Yang Ha-young, Director of ASEC at AHNLAB,INC.(053800), said, “It is important to strengthen basic security measures in advance,” adding, “Simply following basic security guidelines that can be practiced in daily life—such as using different passwords for each service and setting up multi-factor authentication—can help reduce the risk of account hijacking and secondary damage.”