South Korea’s Financial Security Institute Hacked, Personal Information Leaked

South Korea’s Financial Security Institute (FSI), an organisation responsible for supporting cybersecurity across the country’s financial sector, has suffered a hacking attack that exposed personal information from its financial-company assessment system.

The reported leak involved approximately 200 administrative forms, more than 300 personal-information records and around 350 system-user records, according to reports published on November 10 and 11.

The affected platform was used by financial institutions to submit administrative documents and supporting materials for information-security assessments. FSI detected unauthorised external access at approximately 3 p.m. on November 9 and immediately blocked access to the affected system.

The institute subsequently reported the incident to South Korea’s Financial Services Commission (FSC) and the Korea Internet & Security Agency (KISA), according to Yonhap News Agency.

The incident is particularly concerning because FSI plays an important role in identifying security weaknesses and supporting responses to cyber threats across the country’s financial industry.

However, the available reporting does not establish that South Korean banks’ core transaction systems, ordinary customers’ bank accounts or payment infrastructure were compromised.

FSI is a specialised organisation that supports information security across South Korea’s financial sector. Its responsibilities include monitoring financial-sector cyber threats, investigating security incidents and helping financial institutions assess their security practices.

The system targeted in this incident is known as the Continuous Evaluation Support System, also described in reporting as the Continuous Assessment System. It provides a platform through which financial companies submit administrative forms and other materials required for information-security assessments.

In simple terms, financial institutions use the platform to provide documents that help FSI evaluate how they manage information security and protect customer-related information. It is an assessment and document-submission service, not the system used to process customers’ everyday banking transactions.

Korea JoongAng Daily reported that the affected platform was an external-facing system separate from FSI’s core internal network. That distinction is important: a breach of an assessment platform is serious, but it does not automatically mean that the internal systems of every financial institution connected to it have been compromised.

The Herald Business reported that information associated with approximately 40 financial companies had been affected. Much of the reported impact was concentrated in the mutual-finance sector, including regional agricultural cooperatives and credit unions.

The publication said major commercial banks and other first-tier financial institutions were not involved, based on information from an FSI official. The final scope remained under investigation.

According to Yonhap, FSI detected unauthorised external access at around 3 p.m. on November 9, 2026. The institute immediately blocked access to the affected system and reported the incident to the FSC and KISA.

November 9 is the reported detection date. It should not be treated as the date the attacker first entered the system. The initial intrusion date and the length of time the attacker may have had access have not been publicly established.

Reporting from SBS and The Herald Business identified several categories of exposed information. Approximately 200 administrative forms were involved, including sample consent forms relating to personal credit information.

More than 300 personal-information records contained in those documents reportedly included names and dates of birth.

A separate category involved around 350 system-user records. These reportedly contained names, partially masked mobile phone numbers and email addresses.

Much of the exposed personal information is believed to belong to employees responsible for continuous assessment work at financial companies.

These figures describe different types of material and must not be combined into a claim that 650 individual people were affected. The 200 forms are documents, while the other figures refer to information records.

The available reporting does not establish the exact number of unique individuals represented or whether records overlap.

The Herald Business also reported that the Financial Services Commission instructed FSI to extend its review to areas where information exposure had not yet been confirmed. The figures available on November 11 should therefore be treated as an initial reported scope rather than a final count.

FSI reportedly said that the affected assessment platform did not process ordinary customers’ financial transactions or collect sensitive technical security information such as financial companies’ vulnerability-analysis results.

FSI also said that financial institutions’ system architecture diagrams, resident registration numbers and sensitive personal credit information belonging to financial customers had not been identified among the leaked material.

These distinctions matter because the presence of personal information in an administrative document does not mean that banking credentials, account balances or transaction histories were exposed.

The Herald Business reported that major commercial banks and other first-tier financial institutions were not among the affected organisations, with the reported impact concentrated in mutual-finance institutions.

This does not mean that every possible risk has been ruled out, particularly because regulators had requested additional checks.

The statements about information that was not exposed reflect FSI’s reported findings during the initial investigation. They should not be interpreted as an independently completed examination of every connected system or record.

The complete method used in the attack has not been publicly established. However, reports published on November 10 and 11 provided some information about the suspected access route.

Yonhap reported that the attacker repeatedly changed Internet Protocol (IP) addresses to make external connections appear more like legitimate access.

An IP address helps identify the network connection communicating with an online service. Changing addresses can make suspicious activity more difficult to recognise, particularly when security monitoring relies too heavily on familiar connection patterns.

A more detailed report published by Chosun on November 11 said that more than 100 IP addresses had been used. It also reported that the attacker impersonated an official from South Korea’s Financial Supervisory Service (FSS) and used a temporary access route that reportedly did not require the platform’s usual SMS verification.

According to Chosun, FSI had maintained a separate access page as a backup for situations in which SMS authentication failed. The report said the attacker used this route, raising questions about how an account impersonating an FSS official was approved and whether the exception to the normal authentication process was properly managed.

However, the exact access sequence remains unresolved. The Herald Business separately reported that the attacker and IP-address details had not yet been confirmed.

The reported use of more than 100 IP addresses should therefore be understood as a detail attributed to Chosun’s reporting, not a final independently established forensic finding.

There is no publicly established evidence in the reporting reviewed for this article that identifies a specific malware family, a confirmed software vulnerability or a malware-based intrusion. It is also not clear whether stolen credentials, another compromised system or a different initial access method played a role.

FSI reportedly blocked access to the affected system after detecting the incident on November 9 and notified the Financial Services Commission and KISA. The institute also began investigating the cause of the breach and the amount of information that may have been exposed.

The official assessment-system website provides an additional detail about the service interruption. Its notice says the server was suspended for system maintenance from 6 p.m. on November 9 until a separate announcement.

It also said the period for submitting objections would be extended because of the interruption. The notice does not provide a confirmed restoration date.

On November 11, the Financial Services Commission and Financial Supervisory Service began an on-site investigation at FSI, according to reporting by Yonhap Infomax. The authorities were examining the circumstances of the incident and FSI’s security management arrangements.

The Herald Business reported that the FSC instructed FSI to investigate areas where information exposure had not yet been confirmed. This additional review was important because the initial figures did not necessarily represent the final scope of the incident.

There were also developments concerning notifications. The Herald Business reported that FSI began individually notifying affected financial companies by telephone on the evening of November 10 and continued doing so.

The institute also planned to inform individuals whose information had been exposed about the incident and steps intended to prevent further harm.

That distinction is important: notification of affected financial companies does not establish that every individual whose information was involved had already been contacted by November 11.

FSI also said it would investigate the cause, review its wider information-security management framework and take steps to prevent similar incidents.

The Herald Business reported that the institute said it would provide compensation if individuals suffered actual damage resulting from the information leak. This was a reported commitment, not evidence that compensation had already been paid.

The reported information appears to be concentrated around financial-company personnel and people involved in security assessments, rather than ordinary bank customers. Nevertheless, names, dates of birth, email addresses and contact details can help criminals create more convincing messages.

For example, someone who knows that an individual works with a financial institution could send a message pretending to come from a bank, a regulator or a security department. Including genuine personal details can make a fraudulent email or text message appear more trustworthy.

Criminals could also take advantage of public awareness of the incident. A message claiming to provide an official breach notification, compensation payment or account-protection service might encourage someone to open a suspicious link or disclose additional personal information.

These are potential risks associated with exposed contact information. The reporting reviewed for this article does not establish that phishing, impersonation or financial scams have already been carried out using information from this particular incident.

Anyone receiving an unexpected message about the breach should treat it cautiously. Avoid opening unfamiliar links or attachments, and never share passwords, banking credentials or one-time verification codes with someone who contacts you unexpectedly.

If a message claims that your information was involved, verify it using contact details independently obtained from the relevant financial institution or organisation. Do not rely on telephone numbers, email addresses or website links supplied in an unexpected message.

There is also no reason for every South Korean bank customer to assume that their account has been compromised. The available reporting does not establish that ordinary customers’ transaction records or banking credentials were exposed.

Automatically freezing accounts or changing every banking password is not justified by the information currently available, although anyone who receives a genuine security notification should follow the relevant organisation’s instructions.

Several important questions remain unanswered. Investigators have not publicly established when the attacker first obtained access, how long unauthorised access continued or the complete sequence of actions used to enter the system.

The precise access method also remains unresolved. Chosun reported impersonation of an FSS official and the use of an alternative authentication route, but the process through which the account was approved still required investigation.

Reports also differed over whether the IP-address details had been fully confirmed.

The exact number of unique individuals affected has not been established. The reported document and record figures are not a verified count of people.

The final scope of the exposure also remained under review, and the available reporting did not establish whether every exposed record was downloaded or whether additional information would be identified.

The identity of the attacker and the motive behind the incident have not been publicly confirmed. The official service notice also did not establish when the assessment platform would return to normal operation.

For now, the established picture is that FSI experienced unauthorised access to its assessment platform, personal information was exposed and the affected service was restricted.

Financial authorities were investigating the incident, while the available evidence did not establish a compromise of ordinary customers’ bank accounts or South Korea’s core banking transaction systems.

The breach is serious because an organisation responsible for supporting financial-sector cybersecurity experienced an incident within one of its own systems. But understanding the actual scope matters just as much as recognising the seriousness of the attack.

The evidence available on November 11 supports a significant information-exposure incident, not a confirmed breach of South Korea’s entire banking system.