Headline: Hackers breach South Korea’s Financial Security Institute — hundreds of staff records and dozens of firms affected amid wider industry security crisis South Korea’s Financial Security Institute (FSI), an organization that helps guard the nation’s financial sector against cyber threats, was breached in early November — less than two weeks after a separate intrusion at crypto exchange Bithumb. According to a November 11 Chosun Daily report, attackers posed as an official from the Financial Supervisory Service (FSS) and exploited an alternate authentication route to access the institute’s systems. What happened - The institute discovered the intrusion on November 9 and immediately blocked access to the compromised system. - Attackers targeted the Continuous Evaluation Support System, an online portal used by financial firms to submit documents and undergo security assessments. - Hackers exploited a temporary access page designed for cases when SMS authentication fails. That alternate path lacked the same verification checks and allowed entry using an account that appeared to belong to the FSS. - During the operation, the intruders used more than 100 different IP addresses and frequently rotated connections to avoid detection. Scope of the breach - Preliminary findings show that records tied to more than 40 financial companies were exposed. - Compromised materials included about 200 administrative forms, roughly 300 personal information records (names and dates of birth), and about 350 system-user records with partially masked names and phone numbers. - Most of the personal data belonged to employees responsible for security assessments at financial institutions. - The FSI says the affected platform did not contain sensitive network configurations, vulnerability assessment results, or customers’ personal credit data. - The breached account reportedly carried permissions normally reserved for financial regulators — allowing a view across multiple institutions’ submissions — and investigators are probing how those permissions were granted. Response and investigation - The institute reported the incident to the Financial Services Commission (FSC) and the Korea Internet & Security Agency (KISA), and informed affected companies and impacted employees. - Police received technical data, including IP address logs, on November 10. Financial regulators began an on-site security inspection the following day. - The FSI has pledged to review its security procedures and said it would compensate victims if further harm arises from the exposed data. Broader context: mounting cyber threats to Korea’s finance and crypto sector - The FSI breach follows a string of cybersecurity issues across South Korea’s financial industry this fall, including crypto-sector incidents. - On October 27, Bithumb confirmed an unauthorized party accessed its internal mobile groupware used for employee communications; the exchange said that system was separate from trading infrastructure and could not be used to touch customer crypto holdings. - Regulators identified security incidents at 16 financial institutions in October — including two crypto businesses — and reported about 100,000 customer records exposed. A sector-wide review found security weaknesses at 130 of 555 companies examined. - Other recent incidents: Daishin Securities disclosed exposure of personal and credit information for 38,490 customers; Mirae Asset Global Investments reported unauthorized access to certain systems; and crypto exchange GOPAX temporarily suspended trading and withdrawals on November 6 after receiving a threat email (it moved assets to offline wallets and introduced a manual withdrawal process, reporting no confirmed theft). - Following the October 29 Binance hack, South Korea’s FSC instructed domestic crypto exchanges to tighten administrator access controls, withdrawal approvals and transaction monitoring. Cold-storage snapshot (regulatory baseline) - Under South Korean rules, exchanges must hold at least 80% of customer crypto assets in cold storage. - As of the end of September: Bithumb reported 94.76% of customer assets offline; GOPAX reported 80.54%. Why it matters for crypto and finance readers - The FSI breach underscores that supply-chain and oversight systems — not just exchanges — are attractive targets. Access to a regulator-like account allowed attackers to view security-submission data across multiple firms, raising concerns about how administrative privileges and authentication exceptions are managed. - With multiple recent incidents and regulators tightening controls, exchanges and financial firms must harden admin access, multi-factor flows, and alternate-access mechanisms to prevent similar escalations. The investigation is ongoing. Authorities and the FSI continue to hunt for the intruders’ origin and to determine whether further damage will surface from the exposed records. Read more AI-generated news on: https://app.chaingpt.org/news