Continuous evaluation system breached
Mutual finance sector hit hardest; major banks unaffected
About 300 personal records and 350 user records leaked
FSC orders review of areas where leaks remain unconfirmed
Affected firms notified individually; investigation ongoing
The Korea Financial Security Institute, widely regarded as the last line of defense in the financial sector's cybersecurity infrastructure, has been hacked, with more than 300 personal records confirmed leaked. The breach was concentrated in the mutual finance sector — including regional agricultural cooperatives and credit unions — while major commercial banks and other first-tier financial institutions were unaffected. Financial regulators have ordered a review of areas where data leaks have yet to be confirmed, to assess whether additional information was compromised.
According to the Korea Financial Security Institute, an unauthorized external intrusion into its continuous evaluation system for financial companies was detected at around 3 p.m. Monday. The institute immediately blocked access to the system and reported the breach to the Financial Services Commission and the Korea Internet & Security Agency (KISA).
The financial institutions affected by the incident were concentrated in the mutual finance sector. "First-tier financial institutions were not involved — the vast majority are mutual finance entities such as some regional agricultural cooperatives, credit unions and forestry cooperatives," an institute official said.
The data confirmed leaked so far includes approximately 200 administrative forms — such as sample consent forms for personal credit information — along with more than 300 personal records contained in those forms, including names and dates of birth. Most of the leaked personal information belonged to employees at financial companies responsible for continuous evaluation duties. Separately, more than 350 system user records were also leaked, including names with some mobile phone numbers partially masked, as well as email addresses.
The breached continuous evaluation system is a platform through which financial companies submit administrative forms required for assessments. The institute said the system does not collect sensitive security information such as vulnerability analysis results, nor does it process financial transactions of general customers. Sensitive data — including financial companies' system architecture diagrams, resident registration numbers and customers' personal credit information — was not among the leaked material.
The FSC directed the institute to extend its review to areas where leaks have not yet been confirmed. "We were briefed on the incident Tuesday evening and instructed the institute to examine areas where leaks have not been verified," an FSC official said. The institute immediately launched the additional review.
The full scope of the breach and the method of attack remain under investigation. "The investigation is still ongoing, so the final scale of the leak has not been determined," an institute official said. "There may be additional information identified, but we do not expect new damage to occur." The identity of the attacker and the IP address used have also yet to be confirmed.
Beginning Tuesday night, the institute has been individually notifying affected financial companies by phone and continues to do so. It also plans to inform the individuals whose data was leaked about the incident and steps to prevent secondary harm, and said it will actively compensate any victims who suffer actual damage.
The institute said it will investigate the cause of the incident and whether additional data was leaked, while conducting a comprehensive review of its overall information security management framework. "We take this incident with the utmost gravity and are committed to thoroughly reviewing and overhauling our information security systems to restore trust," an institute official said.
Meanwhile, the FSC told the office of People Power Party lawmaker Seo Il-jun that no hacking attempts or personal data leaks had been detected in the information systems of the FSC or the Korea Financial Intelligence Unit (KoFIU).
snsd@heraldcorp.com
rim@heraldcorp.com
hyuk@heraldcorp.com
