Financial security agency hit by data breach - 동아일보

The Financial Security Institute (FSI), which oversees cybersecurity at financial institutions, has suffered a cyberattack that exposed about 850 records containing personal information submitted by 48 financial companies. The system targeted in the attack had already been flagged in an audit four years earlier for its vulnerability to data leaks, raising questions about the institute's failure to address known security weaknesses despite its role as the financial sector's dedicated cybersecurity agency.

Breach Details

The FSI announced on Nov. 11 that hackers had gained unauthorized access to its year-round assessment system at about 3 p.m. on Nov. 9. The system evaluates financial institutions' information security practices. The breach involved about 130 files submitted by 48 financial companies, containing roughly 200 administrative documents and about 300 pieces of personal information, including names and dates of birth. Another 350 records held information about system users.

As a specialized financial security agency, we are expected to maintain the highest standards of security and trust. We sincerely apologize for causing concern to financial institutions and the public.

Previous Warnings

The year-round assessment system serves more than 3,000 institutions. The risk of information leaks through the system had already been identified by the Financial Services Commission in a 2022 special audit. The commission noted that employees could access the system from personal computers and warned that "supporting documents stored in the year-round assessment system contain important information belonging to financial companies, and accessing them from terminals exposed to external networks could lead to the leakage of sensitive information."

Response Timeline

In the immediate aftermath of the attack, the FSI posted a notice announcing maintenance for a "service overhaul" without disclosing the breach. It did not officially acknowledge the incident until late Nov. 10. The breach has renewed criticism that the FSI failed to address security vulnerabilities despite receiving an explicit warning years earlier.