Financial regulators, who have been urging financial companies to prevent hacking incidents and strengthen CEO accountability for security, are now facing a data breach at the Financial Security Institute (FSI). This incident has raised questions about the institute's own security management system, especially as it is responsible for assessing vulnerabilities in financial companies.
According to the financial sector on November 11, the FSI confirmed a data breach due to abnormal external access to its ongoing evaluation system for financial companies on November 9 at around 3 p.m.
The confirmed leaked information includes approximately 200 administrative forms, such as samples of personal credit information consent forms, along with over 300 pieces of personal data, including names and birthdates, and 350 user information records. The user information includes masked names, mobile phone numbers, and email addresses.
The FSI stated that sensitive personal credit information and resident registration numbers have not been leaked. The ongoing evaluation system is where financial companies submit necessary administrative forms for assessments, and it does not collect security information such as vulnerability analysis and evaluation results.
This incident occurred as financial authorities are pushing for security checks and enhanced accountability among executives across the financial sector in response to a series of hacking incidents and data breaches. Regulators have indicated they will rigorously enforce penalties for any confirmed security violations.
The FSI, which operates under the Financial Services Commission, supports the analysis and evaluation of vulnerabilities in financial companies' IT systems and responds to security incidents. Given that a breach occurred at an institution dedicated to identifying and improving security vulnerabilities, there are calls for a thorough review of the FSI's own protective measures and management systems.
A financial sector official remarked, “There was a perception that the FSI would be relatively safe, so the occurrence of a breach at a specialized security institution is concerning.”
The Financial Services Commission has instructed the FSI to quickly ascertain the circumstances and extent of the data breach and to proceed with recovery measures. They have also ordered a security vulnerability assessment across all systems, not just the affected one, and stated that appropriate accountability will be enforced if any security gaps are identified.
Immediately after confirming the breach, the FSI blocked access to the affected system and reported the incident to the Financial Services Commission and the Korea Internet & Security Agency (KISA). They are currently investigating the exact cause of the breach, the extent of the damage, and any additional leaks. The FSI has committed to informing affected financial companies and individuals about the breach and to re-evaluating its overall information protection management system to implement measures to prevent recurrence.
Professor Lim Jong-in from Korea University’s Graduate School of Information Security emphasized, “This incident should serve as a lesson to thoroughly analyze the causes of the security breach and to ensure effective recovery and prevention measures.”
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.