The Financial Security Institute (FSI) of South Korea — the agency leading the investigation into a wave of bank hacks — has in turn suffered a violation, with attackers obtaining about 300 personal records belonging to people who work in the financial sector.

How the hackers breached the financial security agency

The intrusion exploited a weak point in the institute's login system. The attacker posed as an official of the Financial Supervisory Service (FSS) and obtained access through a backup access page intended for situations in which SMS verification is not available — a page that skipped the usual checks.

Unlike a standard corporate account, which can open only its own files, the fake FSS account used by the attackers could view documents from many institutions simultaneously. According to reports, the attackers kept changing IP addresses to make their activity look like normal traffic, ultimately using more than 100 different addresses.

The FSI discovered the breach on Monday, November 9, and, after shutting down the affected system, reported the incident to the Financial Services Commission and to the Korea Internet & Security Agency.

What data was exposed

The hacked platform was the FSI's Continuous Evaluation Support System, where financial companies upload documents for security reviews; about 3,000 companies undergo this review every year.

The leak included about 200 administrative forms, more than 300 personal records containing names and dates of birth, and about 350 user records with partially anonymized names and phone numbers. Most of the personal data belonged to employees who handle security reviews at financial companies, and more than 40 companies have so far been linked to the breach.

No reports have so far indicated that customers' credit information or transaction records were leaked. The FSI stated that its network diagrams and vulnerability test results were not affected, and it promised to pay compensation if the leaked information causes further damage.

The attackers' IP data was handed over to the police on Tuesday, November 10. The following day, financial regulators began an on-site inspection of the FSI's security. Investigators are still trying to determine how the fake FSS account obtained legitimate access at regulator level.

What the FSI hack means for banks and crypto exchanges

The timing is awkward for the FSI, which has been leading cyber defense for the South Korean financial industry: the institute whose review platform handles security filings from about 3,000 financial companies a year now has its own security under on-site inspection by regulators. Since 2025, it has also been running a team dedicated to digital asset security, led by an ethical hacker, to raise security standards at crypto exchanges.

South Korean exchanges have suffered repeated hacks this year. On October 27, Bithumb reported that an unauthorized party had accessed its internal mobile groupware system, exposing employee information. Daishin Securities (KRX: 003540) stated that the data of 38,490 customers had been compromised.

The regulators counted more than 4.4 million scan attempts in a single day, mostly from North Korean IP ranges. However, an FSI official warned against drawing conclusions, since IP data can be falsified or rerouted and cannot alone prove who is behind an attack.

In October, the Financial Services Commission stated that suspected AI-driven attacks had hit 16 companies, including banks, savings banks and crypto businesses. The number rose to 20 by the end of the month, with about 100,000 records exposed. The inspectors who examined 555 companies found security problems at 130 of them.

On November 6, Gopax, owned by Binance, suspended all trading and transfers and moved customer tokens into offline cold storage. The exchange had not been robbed or breached, but regulators recommended the switch from hot to cold wallets following a series of violations, as reported by Cryptopolitan.

Source: Cryptopolitan