Hackers hit Korea’s Financial Security Institute, accessing info for financial institutions

The logo of the Financial Security Institute.

A cyberattack on the agency responsible for overseeing financial-sector security in Korea has resulted in the leak of personal information belonging to employees of financial institutions.

Government authorities, however, said no sensitive data on the security of such institutions was compromised.

Financial authorities on Tuesday said the Financial Security Institute (FSI) confirmed a data breach caused by a hacking attack the previous day and reported it to the Financial Services Commission (FSC), the sector’s top regulator, and other relevant agencies. Right after detecting the breach, the institute blocked access, while the Financial Supervisory Service, the enforcement and inspection arm of the FSC, launched an investigation into the extent of the damage.

The target of the attack was the FSI-run system of continuous security assessment, which backs administrative work for a service that rates the security levels of financial institutions and is used for exchanging materials with external member entities. After the hack, the system posted a notice saying its servers were “temporarily unavailable due to website maintenance.”

The data in the system was mostly from applications for services offered by financial institutions and related administrative documents. The leaked information reportedly included the names, phone numbers and email addresses of people listed in the documents, with certain portions masked. Authorities are still verifying the number of records leaked.

Government authorities said the breach did not expose any sensitive information, such as details of security vulnerabilities at financial institutions.

“The system was never meant to handle such information,” an FSC official said. “We’ve been informed that no sensitive data was leaked, such as the weak points of financial institutions.”

Yet the breach is expected to have major repercussions for the FSI, which oversees cybersecurity for the financial sector but failed to prevent the attack.

“The mere occurrence of an incident, however minor, at an agency as symbolic as the Financial Security Institute could lead to questions over its reliability,” the official said. “We’ve ordered a comprehensive review of all the institute’s systems to prevent a similar incident from happening again.”