The Financial Security Institute, which supports the financial sector's cybersecurity response, has suffered a hacking attack that leaked some personal information, dealing an unavoidable blow to its credibility. The incident was confirmed just 4 days after financial authorities announced a plan at the institute to overhaul the financial sector's overall security framework. It also comes ahead of the "Financial Information Security Conference (FISCON)", a major information security event for the financial industry, prompting remarks that the timing is awkward.

According to the financial sector on Nov. 11, the Financial Security Institute said on Nov. 10 that it confirmed around 3 p.m. on Nov. 9 that data had been leaked through abnormal external access to a always-on evaluation system that supports assessments of financial companies.

The additionally identified scale of the damage is estimated at about 130 files leaked from 48 financial companies. Large companies were not included among the affected financial firms, it was reported.

The Financial Security Institute explained that the system does not collect security-related information such as vulnerability analysis and assessment results, and it is not a system that processes financial transactions for general financial customers. It said the leaked materials were mostly administrative forms such as records of sending promotional event information and consent forms. It said security information such as diagrams of financial companies' system configurations, resident registration numbers and customers' sensitive personal credit information were not leaked.

Still, separate from whether financial companies' security information or customers' sensitive information was leaked, there are calls for scrutiny because abnormal external access occurred on the system of a security specialist body for the financial sector and led to an actual data leak.

ACCESS THROUGH FAKE ID IMPERSONATING FINANCIAL SUPERVISOR AUTHORITY

In particular, the attack is reported to have involved a hacker creating a fake ID impersonating Financial Supervisory Service authority to access the system. The hackers exploited a vulnerability in the authority approval system to view and download materials. They are also said to have carried out the attack while changing hundreds of internet protocol, or IP, addresses.

It has been determined that actual FSS account information was not leaked or used. Still, the need is growing to review the institute's user authentication and access rights management system because access impersonating financial authorities led to a data leak.

The Financial Security Institute requested a police investigation to track the IP addresses in connection with the incident, and the Seoul Metropolitan Police Agency's cyber investigation unit is reported to have launched an investigation. The possibility that the hackers targeted the institute, unlike a method that randomly searches for vulnerabilities, is also being discussed.

The Financial Security Institute is reported to have detected abnormal access after attacks were concentrated around 1 p.m. to 2 p.m. on Nov. 9 and blocked the system's service at 2:19 p.m. It had previously said it confirmed the data leak around 3 p.m. that day.

After confirming the incident, the institute reported it to the Financial Services Commission and the Korea Internet & Security Agency (KISA). It initiated emergency security measures to prevent additional leaks and launched a detailed investigation into the cause of the incident and the scope of the damage. It individually informed the relevant financial companies of the data leak. It also plans to notify data subjects, such as users linked to the leaked information, of the leak and precautions to prevent secondary damage. It also said it would actively compensate if secondary damage occurs.

INCIDENT 4 DAYS AFTER SECURITY OVERHAUL ANNOUNCEMENT, RAISING DOUBTS OVER POLICY EXECUTION

Financial authorities have also begun determining the circumstances of the incident. The FSC and the FSS sent personnel to the institute's site on the morning of the day to check information security levels and management practices. The inspection is expected to confirm not only how the incident occurred and the scale of the leak, but also why it was possible to create fake accounts and whether existing access rights management and incident response systems were appropriate.

The incident has drawn more attention because it occurred right after financial authorities said just 4 days earlier at the institute that they would overhaul the financial sector's overall security framework. The FSC held a "financial sector meeting on innovating the security framework in the AI era" on Nov. 5 at the institute's Yeouido branch under the chairmanship of FSC Chairman Lee Eok-won (이억원).

The FSC presented measures including a comprehensive inspection of external contact points and internal control systems for about 580 financial companies, and shortening the vulnerability analysis and assessment cycle from once a year to at least twice a year starting with large financial companies. The aim is to more closely inspect security vulnerabilities of financial companies and strengthen proactive response capabilities against security incidents.

The Financial Security Institute in particular was tasked with serving as a key implementing agency for such policies. Financial authorities have said the institute would sequentially support from December a "one-stop AI defense service" that uses artificial intelligence to continuously search for external contact points and vulnerability factors and provide response measures to bolster the security capabilities of small and mid-sized financial companies.

But with a data leak occurring at the institute, which is supposed to find and support responses to other financial companies' external contact points and security vulnerabilities, how to verify the security capabilities of the policy implementing body itself has emerged as a new task.

In particular, since the attack is said to have used a fake account impersonating financial authorities, it is also an area that needs to be examined whether the institute's access rights approval and management systems were appropriate.

With just a month left before support for the one-stop AI defense service, the circumstances of the breach of the institute's own system have yet to be fully identified. It has not been confirmed that the incident is directly related to the service. Still, for the policy to gain trust, the security management system of the implementing agency itself may need to be verified.

HACKING AHEAD OF 20TH ANNIVERSARY FISCON, VIP EVENT ALSO CANCELED

The incident is also drawing attention because it occurred ahead of "FISCON 2026," which the Financial Security Institute will hold on Nov. 12. The host organisation of a major event to discuss responses to cyber threats in the financial sector has been put in a position of handling a breach of its own system.

The institute is reported to have fully canceled the VIP event for FISCON 2026 due to the fallout from the incident. Some official schedules were canceled for an event that had been planned for major financial industry executives and chief information security officers to attend and discuss future strategies for financial security.

FISCON, marking its 20th anniversary this year, is a major domestic financial information security event co-hosted by the Financial Security Institute with the Financial Information Security Council and the Financial Security Forum. It is sponsored by the FSC and the FSS, among others, and brings together financial company chief executive officers and chief information security officers, as well as domestic and foreign security experts, to discuss financial security policies, the latest cyber threats and response strategies.

This year's event is set to seek security strategies to respond to a future financial environment changed by AI. The institute had planned to share practical solutions for responding to cyber attacks increasingly advanced by AI and shifting to a proactive security framework. A point to note is that many of the main agendas of this event are focused on early detection and response to cyber threats and the advancement of security management systems.

According to the program announced earlier, key lecture topics include trust and security in the AI era, zero trust-based security strategies and ways to respond to cyber threats using AI. Detailed seminars also cover major topics such as response strategies by financial companies to changes in network separation regulations, establishing AI governance, changes in hacking attacks and defense methods in the financial sector, and AI-based penetration tests.

In the end, what the event emphasizes is the securing of security capabilities that can detect and respond to cyber threats in advance.

But with an actual data leak at the Financial Security Institute, which hosts the event, and even the VIP event canceled, the need has grown to review how faithfully these security principles were being implemented within the institute's own systems.

Beyond simply presenting new security technologies and response strategies, how specifically the institute itself can identify and improve problems in its existing security framework is expected to be an important task in restoring trust as a specialist organisation.

OVER 2 YEARS INTO PUSH FOR FINANCIAL SECURITY FRAMEWORK LAW, BILL DRAFTING PUT OFF UNTIL NEXT YEAR

Work to overhaul the legal framework related to financial security is also being delayed compared with the initial plan. The FSC first presented a plan in August 2024 to enact a digital financial security law, and at last year's FISCON, Chairman Lee said it would immediately begin discussions to enact a "digital financial safety law."

But despite more than 2 years of emphasis on the need for enactment, the bill remains in the drafting stage. In its security-system innovation plan on Nov. 5, the FSC presented a schedule to draft a digital financial safety bill in the first quarter of 2027 to expand regulation of financial security and strengthen responsibility for security management.

With security incidents continuing in the financial sector and a data leak even at a security specialist body, the need is also growing to examine whether institutional improvements to respond to financial security threats are being made quickly enough.

The Financial Security Institute's position is that it will investigate whether there were additional leaks beyond the information confirmed so far and will review the overall information protection management system, including determining the cause of the incident, to prepare fundamental measures to prevent recurrence.

An institute official said, "Even though trust is our lifeline, we are sorry that an unfortunate incident occurred. We take this incident seriously and, with a determination to completely transform ourselves, we will thoroughly inspect and improve the overall information protection system and do our best to restore trust."