Korea's financial cybersecurity watchdog hit by hacking attack, internal data leaked

The Korea Financial Security Institute, the Financial Services Commission's dedicated financial cybersecurity agency, suffered a hacking attack that exposed some internal data related to security assessments of financial firms, it has been confirmed.

The institute detected the breach Monday and reported it to the FSC and other authorities.

The target of the attack was the institute's continuous information security assessment support system, which helps financial firms evaluate their security status on an ongoing basis. Some of the responses that individual financial firms had submitted about their security conditions may have been leaked externally as a result of the breach.

The homepage of the continuous assessment support system currently displays only a notice stating that the server has been temporarily suspended for a service overhaul. The institute has notified individual financial firms believed to have been affected and told them that sensitive personal information was not among the leaked data.

Authorities are still working to determine the exact nature and scope of the leaked information as well as the method of attack, given that the institute holds sensitive data from across the financial sector. According to materials the institute released earlier this year, about 3,000 entities are subject to the continuous information security assessment, which reviews how each company protects personal credit information.

A financial authority official said sensitive personal information did not appear to have been leaked, but added that the incident must be treated with the utmost seriousness from a credibility standpoint, given that the institute is the very body responsible for monitoring cyber threats across the financial sector. The official said authorities had called for a thorough investigation and measures to prevent a recurrence.

Meanwhile, the Korea Financial Security Institute is an FSC-affiliated agency that provides specialized financial security services, including responses to cyber threats targeting the financial sector, research on financial security policy and technology, and financial security education. The hacking has not spread to the systems of other financial regulators, including the FSC and the Financial Supervisory Service, as of now.