South Korea's Financial Security Institute (FSI) — the agency leading the investigation into a wave of bank hacks — has itself been breached, with attackers obtaining roughly 300 personal records belonging to people who work in the financial sector.

How hackers broke into the financial security agency

The intrusion exploited a weak spot in the institute's login system. The attacker posed as an official from the Financial Supervisory Service (FSS) and gained access through a backup access page intended for situations in which text-message verification is unavailable — a page that skipped the usual checks.

Unlike a standard corporate account, which can only open its own files, the fake FSS account used by the attackers could view documents from many institutions at once. The attackers reportedly kept changing their IP addresses to make their activity look like normal traffic, ultimately cycling through more than 100 different addresses.

The FSI discovered the breach on Monday, November 9, and, after shutting down the affected system, reported the incident to the Financial Services Commission and the Korea Internet & Security Agency.

What data was exposed

The hacked platform was the FSI's Continuous Evaluation Support System, where financial firms upload documents for security reviews; about 3,000 companies go through this review each year.

The leak included about 200 administrative forms, more than 300 personal records containing names and birth dates, and about 350 user records with partly hidden names and phone numbers. Most of the personal data belonged to employees who handle security reviews at financial firms, and more than 40 companies have so far been linked to the breach.

No reports so far indicate that customer credit information or transaction records were leaked. The FSI has said its network diagrams and vulnerability test results were not affected, and it has promised to pay compensation if the leaked information results in further harm.

Police were given the attacker's IP data on Tuesday, November 10. The next day, financial regulators began an on-site inspection of the FSI's security. Investigators are still trying to determine how the fake FSS account gained legitimate regulator-level access.

What the FSI hack means for banks and crypto exchanges

The timing is awkward for the FSI, which has been leading cyber defense for Korea's financial industry: the institute whose review platform handles security filings from roughly 3,000 financial companies a year now has its own security under on-site inspection by regulators. Since 2025, it has also run a digital-asset security team, led by an ethical hacker, to raise security standards at crypto exchanges.

Korean exchanges have been hacked repeatedly this year. On October 27, Bithumb reported that an unauthorized party had reached its internal mobile groupware system and exposed employee information. Daishin Securities (KRX: 003540) said data on 38,490 customers was compromised.

Regulators counted more than 4.4 million scanning attempts in a single day, mostly from North Korean IP ranges. However, an FSI official warned against drawing conclusions, since IP data can be faked or rerouted and cannot on its own prove who is behind an attack.

In October, the Financial Services Commission said suspected AI-driven attacks hit 16 firms, including banks, savings banks and crypto businesses. That number rose to 20 by the end of the month, with about 100,000 records exposed. Inspectors who reviewed 555 companies found security problems at 130 of them.

On November 6, Gopax, which is owned by Binance, halted all trading and transfers and moved customer tokens into offline cold storage. The exchange had not been robbed or breached, but regulators recommended the shift from hot to cold wallets following a series of breaches, as Cryptopolitan reported.

Source: Cryptopolitan