Victims include local agricultural cooperatives, credit unions and forestry cooperatives

More than 130 files leaked via fake FSS-level account

Attack IPs show no overlap with previously known hacking attempts

FSC launches on-site inspection; police open investigation

A sign for the Financial Security Institute's Yeouido office is seen in the lobby of the Financial Investment Center Building in Yeouido, Seoul, on Wednesday. [Yonhap]
A sign for the Financial Security Institute's Yeouido office is seen in the lobby of the Financial Investment Center Building in Yeouido, Seoul, on Wednesday. [Yonhap]

All 48 financial institutions whose data was leaked in the cyberattack on the Financial Security Institute belong to the mutual finance sector. Local agricultural cooperatives, credit unions and forestry cooperatives were among those affected, while no damage was found at institutions in other financial sectors. All 236 IP addresses used in the attack have been traced to domestic sources.

The breach is believed to have resulted in the leak of more than 130 files submitted by 48 mutual finance institutions, according to financial industry sources Wednesday. "All 48 affected institutions are in the mutual finance sector — mostly local agricultural cooperatives, credit unions and forestry cooperatives, with no other sectors involved," a Financial Security Institute official said.

The leaked data included roughly 300 records containing personal information such as names and dates of birth, as well as about 350 records of system user information. In the system user data, portions of names and mobile phone numbers had been masked. Approximately 200 administrative forms were also leaked, including sample personal credit information consent forms.

All 236 IP addresses used in the attack were domestic. "There are quite a few — 236 attack IPs — and what is unusual is that every single one is a Korean IP," the official said. "None of them overlap with IPs that had previously attempted hacking." The official added that the identity of the perpetrators had not yet been determined and that an investigation was underway.

On why the damage was concentrated in the mutual finance sector, the official said mutual finance files may have appeared first when the hacker was browsing through data, and that the connection was cut before the attacker could go further. "It is difficult to pinpoint why only mutual finance institutions were specifically targeted," the official said.

The hack is believed to have been carried out through a fake account holding the same access privileges as the Financial Supervisory Service. The attacker exploited a vulnerability in the Financial Security Institute's authorization process; no actual FSS account was compromised. The institute detected abnormal access activity Monday afternoon and suspended operations of its information security continuous assessment site at 2:19 p.m. that day. The site, where financial companies submit documents required for information security evaluations, remains inaccessible.

The Financial Services Commission began an on-site inspection at the Financial Security Institute Wednesday morning to examine the circumstances of the incident. FSS personnel are also assisting with the inspection, though the FSC is leading the probe. "The FSC has sent a team for the on-site inspection, and I understand FSS staff are cooperating," the institute official said. "It is unclear how long the inspection will last, but further investigation appears necessary at this point."

A police investigation is also underway. The Financial Security Institute received a call from police Tuesday and requested that they trace the IP addresses used in the attack. The Seoul Metropolitan Police Agency's cyber investigation unit has taken up the case.


snsd@heraldcorp.com