South Korea’s Financial Security Institute (FSI) has been hit by a cyberattack that exposed around 300 personal records, mostly belonging to employees of financial institutions, along with documents from over 40 financial firms. The FSI is the agency that has been investigating the country’s wave of bank hacks.
The attackers targeted the institute’s Continuous Evaluation Support System, an online platform financial companies use to submit documents and undergo information security assessments. They impersonated Financial Supervisory Service (FSS) officials and exploited a temporary access page, intended for use when SMS authentication was unavailable, to bypass verification. They also used more than 100 IP addresses to evade detection. The FSI found the breach on Monday, November 9, shut down the affected system, and reported the incident to the Financial Services Commission and the Korea Internet & Security Agency. Regulators began an on-site security check the following day. Police have also opened an investigation.
The breach lands in the middle of an escalating campaign against Korea’s crypto sector. The FSI runs a digital-asset security unit tasked with strengthening crypto exchanges. Those exchanges have been hit in the same wave: Bithumb disclosed an employee-data breach on October 27, and GOPAX halted trading on November 6. GOPAX suspended trading and withdrawals after receiving an email threatening a cyberattack, and said it had not detected an actual intrusion or theft. Brokerage Daishin Securities separately said data on 38,490 customers had leaked, and Mirae Asset also reported a hacking incident.
The broader audit picture is not reassuring. Inspectors who reviewed 555 companies found security problems at 130 of them, per Cryptopolitan. The Financial Services Commission plans a full security inspection of about 580 financial companies by year-end. No theft of funds has been reported in the earlier incidents.
The compromised documents are security assessment filings. That makes the leak potentially more useful to attackers than raw personal data, because it may map weaknesses across dozens of institutions. Korean exchanges, already under on-site scrutiny since Bithumb’s disclosure, should expect stricter security requirements once the FSC concludes its year-end review.
