Hackers breach Korea's financial security agency through fake FSS account, exposing data from 48 mutual finance institutions

A cyberattack on the Korea Financial Security Institute has exposed data from 48 mutual finance institutions, while also revealing lax personal data management at some of the financial firms involved. Some companies submitted documents without properly masking personal information, and the institute failed to stop the external intrusion. Security industry experts say the incident underscores the need to review whether basic security measures — including authentication and access control — are being properly implemented.

The Financial Services Commission began an on-site inspection of the Korea Financial Security Institute on Wednesday and continued it Thursday, according to financial industry sources. An institute official said the investigation is focused on "a vulnerability that allowed a fake account with Financial Supervisory Service privileges to be created and used to access the system."

The breach occurred in the institute's information security continuous assessment support system, which financial companies use to self-evaluate their personal credit data protection practices and submit supporting documents. The hack on Monday is believed to have resulted in the leak of more than 130 files belonging to 48 mutual finance institutions, including regional agricultural cooperatives, credit unions, forestry cooperatives and saemaul geumgo. No damage to other financial sectors has been confirmed.

The leaked data included about 200 administrative forms — such as sample personal credit information consent forms — along with roughly 300 records containing personal details including names and dates of birth. Information on about 350 system users was also compromised. It was further confirmed that some financial companies had failed to mask personal information when submitting their documents. "Masking personal information is standard practice, and we have communicated this to financial companies," an institute official said. "The personal information that was leaked belongs to those companies that did not follow the guidelines."

Beyond the negligence of individual financial firms, the institute's own authentication and access control framework has come under scrutiny. The hacker created a fake account with FSS-level privileges and used it to download files submitted by financial companies. A total of 236 domestic IP addresses were used in the attack. The institute is investigating how the fake account was created and who was behind the intrusion.

The need to strengthen basic security management in the financial sector was also highlighted at the Financial Information Security Conference held Thursday at the Conrad Seoul hotel in Yeongdeungpo-gu, Seoul. Experts called for tighter personal data protection measures and stricter per-account access controls, as well as the construction of a multilayered defense system capable of preventing data exfiltration even after an initial breach.

Kim Kyung-ha, chief executive of J&Security, stressed the importance of actually implementing basic security safeguards. Kim advised financial institutions to maintain a complete inventory of systems connected to the external internet and to strengthen authentication, access management and access control. A system to monitor all connection and usage logs for anomalous activity is also necessary, Kim said.

Experts also called for measures to contain data leaks even after a hacker has penetrated a system. Yoo Jae-wook, a senior researcher on the Korea Financial Security Institute's RED IRIS team, said multiple layers of security controls should be in place to ensure that the compromise of a single server does not lead to the exposure of sensitive information. Yoo proposed minimizing the privileges of service accounts and deploying mechanisms to detect and block bulk or abnormal data queries.

The conference also featured real-world examples of security improvements at financial firms. Samsung Life Insurance said it has built a zero-trust security framework that verifies the status of users and devices and restricts access to only authorized systems. The company is also developing an AI-based system to detect abnormal behavior, such as excessive queries of customer information. Rather than focusing solely on blocking initial intrusions, the approach involves continuously monitoring the entire lifecycle of account use and data access.