South Korea’s Financial Security Institute (FSI), the agency investigating a wave of bank hacks, has itself been hacked.
Attackers got hold of about 300 personal records of people who work in the financial sector.
How did hackers break into South Korea’s financial security agency?
South Korea’s Financial Security Institute (FSI) got hacked after the attackers exploited a weak spot in the institute’s login system.
The hacker pretended to be an official from the Financial Supervisory Service (FSS) and gained access to the FSI’s system through a backup access page meant for times when text-message verification is not available. That page skipped the usual checks.
The fake FSS account used by the attackers can see files from many institutions at once, unlike a normal company that can only open its own. The attackers reportedly kept changing their IP addresses to look like normal traffic and ended up using more than 100 different addresses.
The FSI found the breach on Monday, November 9, and after shutting down the affected system, it reported the incident to the Financial Services Commission and the Korea Internet & Security Agency.
The hacked platform was the FSI’s Continuous Evaluation Support System, where financial firms upload documents for security reviews. About 3,000 companies go through this review each year.
About 200 administrative forms were leaked as well as more than 300 personal records with names and birth dates, and about 350 user records with partly hidden names and phone numbers.
Most of the personal data belonged to employees who handle security reviews at financial firms. So far, more than 40 companies have been linked to the breach.
So far, no reports show that customer credit information or transaction records were leaked during the breach. The FSI has said its network diagrams and vulnerability test results were not affected. It also promised to pay compensation if the leaked information results in further harm.
On Tuesday, November 10, police were given the attacker’s IP data. The next day, financial regulators started an on-site check of the FSI’s security. Investigators are still trying to figure out how the fake FSS account gained legitimate regulator-level access.
What does the FSI getting hacked mean for banks and crypto exchanges?
The timing of the hack is awkward for the FSI, which has been leading cyber defense for Korea’s financial industry. Since 2025, it has also run a team focused on digital-asset security , led by an ethical hacker, to raise security standards at crypto exchanges.
Korean exchanges have been hacked repeatedly this year. For instance, Bithumb reported on October 27 that an unauthorized party had reached its internal mobile groupware system and exposed employee information. Daishin Securities (KRX: 003540) said data on 38,490 customers was compromised.
Regulators counted more than 4.4 million scanning attempts in a single day, mostly from North Korean IP ranges. However, an FSI official warned against drawing conclusions since IP data can be faked or rerouted and cannot prove who is behind an attack on its own.
In October, the Financial Services Commission said suspected AI-driven attacks hit 16 firms, including banks, savings banks and crypto businesses. That number rose to 20 by the end of the month. About 100,000 records were exposed. Inspectors who reviewed 555 companies found security problems at 130 of them.
On November 6, Gopax, which is owned by Binance, stopped all trading and transfers and moved customer tokens into offline cold storage. The exchange hadn’t been robbed or breached, but regulators recommended the change from hot to cold wallets following a series of breaches, Cryptopolitan reported .
The smartest crypto minds already read our newsletter. Want in? Join them .
