/ Courtesy of Financial Security Institute

Police have opened an investigation into a hack at the Financial Security Institute (FSI), the financial industry's security watchdog. The intruder is believed to have created a fake account impersonating the Financial Supervisory Service (FSS), used it to enter the system and then changed IP addresses repeatedly while extracting data. It has been suggested that the hacker exploited the fact that the FSS has broader data access rights than ordinary financial companies. Police are tracing the attack route and the hacker's identity.

According to financial authorities and others, police told the FSI on November 10, shortly after news of the breach broke, that they would investigate. The Cybercrime Investigation Unit of the Seoul Metropolitan Police Agency is handling the case.

Other recent attacks on financial companies involved hackers probing at random for vulnerabilities. This one appears to have been different: the attacker created a fake account posing as the FSS to gain entry.

The target was the FSI's "Information Security Continuous Assessment Support System." Financial companies use it to submit documents and handle related tasks when they assess and review their security management. It is not thought to be one of the FSI's core security systems.

On this system, ordinary financial companies can see only their own data, and only after the FSI approves their access. The FSS, by contrast, can view far more. The hacker is thought to have learned of this, then logged in through more than 200 IP addresses using the account posing as the FSS, and viewed and downloaded data.

That raises the possibility that the hacker studied the system's account-level access rights and operating procedures beforehand. How the fake account was created and how the hacker obtained permission to view the data, however, remain unclear and require further investigation.

An FSI official said, "The ID and password used by the FSS were not leaked, and this was not credential stuffing," referring to a technique that combines previously leaked IDs and passwords.

The FSI confirmed the leak at around 3 p.m. (KST) on November 9 and blocked access to the system. It could not, however, stop some information from leaking out.

The confirmed leak so far covers more than 130 files from 48 companies.

The files included about 200 administrative forms, such as sample consent forms for personal credit information. They also held more than 300 items of personal information contained in those forms, including names and dates of birth, and more than 350 entries of system user information, such as masked names, masked mobile phone numbers and email addresses. Names were masked, and some financial company customer information was reportedly included as well.

The Financial Services Commission (FSC) began an on-site inspection of the FSI on November 11. It had summoned FSI officials on November 10 for a briefing on the institute's own review, then moved to inspect within a day.

Under the Electronic Financial Transactions Act, the FSC has supervisory and inspection authority over the FSI, while the FSS assists with inspections and other work at the FSC's request. The FSC is expected to examine how the incident occurred, how much data leaked and how the FSI responded.

The FSS is also understood to have asked the FSI to re-examine the security of all the systems it operates from scratch, rather than limiting the review to the assessment system that was breached.

Meanwhile, the FSI has decided to scale back the "Financial Information Security Conference (FISCON) 2026," scheduled for November 12, in light of the hack. The event will go ahead as planned, but it will focus on working-level staff and drop the VIP-related program.

Police have opened an investigation into a hack at the Financial Security Institute (FSI), …

Cybersecurity Breach: How Hackers Exploited Financial Security Agency's Weakness