0
Financial Security Institute logo. /Courtesy of the Financial Security Institute

The Financial Security Institute (FSI), which oversees cybersecurity in South Korea's financial sector, has suffered a cyberattack that exposed hundreds of records, including the personal information of financial company employees. So far, no personal credit information belonging to financial consumers or sensitive security information related to financial companies' internal systems has been found to have been leaked. However, the breach of a specialized institution responsible for supporting cybersecurity responses and information protection across the financial sector has raised concerns about the security of the sector as a whole.

According to financial industry sources on Wednesday, the FSI discovered around 3 p.m. on Nov. 9 that information had been leaked through unauthorized external access to its "Continuous Assessment System," which supports the evaluation of financial companies. The institute immediately blocked access to the system and reported the incident to the Financial Services Commission (FSC) and the Korea Internet & Security Agency (KISA).

The information confirmed to have been leaked so far includes approximately 200 administrative forms, including sample personal credit information consent forms, and more than 300 pieces of personal information, such as names and dates of birth, contained in those forms. In addition, information on approximately 350 system users, with details such as names and mobile phone numbers partially masked, was also leaked. Most of the exposed personal information is believed to belong to employees responsible for continuous assessment work at financial companies.

The Continuous Assessment System targeted in the attack is a platform through which financial companies submit administrative forms and other materials required for information security assessments. The FSI explained that the system does not collect security information, such as the results of vulnerability analyses and assessments, or process transactions for ordinary financial customers.

The FSI has so far confirmed that security information, including financial companies' system architecture diagrams, and sensitive customer information, such as resident registration numbers and personal credit information, were not leaked. However, as some personal information was exposed externally, a detailed investigation is underway to determine the full extent of the damage and whether any additional information was compromised. The attack reportedly involved hackers frequently changing their Internet Protocol (IP) addresses to disguise their activities as legitimate access.

The FSI individually notified financial companies confirmed to have been affected by the breach. It also plans to inform data subjects, including users whose information was exposed, about the incident and measures to prevent secondary harm. The institute also stated that it would actively provide compensation if further damage resulted from the information leak.

In addition to investigating whether more information was leaked, the FSI plans to identify the cause of the incident and conduct a comprehensive review of its information security management system. Given its role as a specialized institution responsible for responding to cyber threats and supporting information protection across the financial sector, the institute intends to focus on identifying vulnerabilities in its own security systems and developing measures to prevent similar incidents from recurring.

"As a specialized financial security institution, we are expected to maintain high standards of security and trust. We sincerely apologize for the concern this incident has caused financial companies and the public," an FSI official said. "We will do our utmost to restore trust by thoroughly reviewing and improving our overall information security framework."

                                                                                                          Han Sang-wook