South Korea’s Financial Security Institute has suffered a cyberattack that exposed hundreds of employee records and documents belonging to dozens of financial companies, less than two weeks after cryptocurrency exchange Bithumb reported a separate security breach.
Summary
- South Korea’s Financial Security Institute suffered a cyberattack that exposed roughly 300 personal information records belonging mainly to financial institution employees.
- Hackers reportedly impersonated a financial regulator and exploited an authentication weakness to access documents associated with dozens of financial companies.
- Financial regulators and police have launched investigations into the breach, while the institute has blocked access to the affected system.
- The incident follows a separate security breach at cryptocurrency exchange Bithumb in October and a hacking threat that prompted GOPAX to suspend trading and withdrawals in November.
According to a November 11 report by Chosun Daily, the attackers impersonated an official from the Financial Supervisory Service (FSS) and exploited weaknesses in an authentication system to gain unauthorized access to the institute’s records.
The institute, which helps protect South Korea’s financial industry against cyber threats, discovered the intrusion on November 9 and subsequently blocked access to the affected system.
Preliminary findings indicate that information associated with more than 40 financial companies was compromised, including roughly 300 personal information records containing names and dates of birth.
Hackers impersonated financial regulator to access security records
The attackers targeted the institute’s Continuous Evaluation Support System, an online platform used by financial companies to submit documents and undergo information security assessments.
Investigators found that the hackers had exploited a temporary access page intended for situations where SMS authentication was unavailable.
The alternative access route did not require the same verification process, allowing the attackers to enter the system through an account that appeared to belong to the FSS.
According to the report, the attackers used more than 100 different IP addresses during the intrusion, frequently changing their connections to avoid detection.
An institute official explained that repeatedly accessing a system from the same address can leave identifiable traces, which may explain why the attackers kept switching addresses.
The compromised account reportedly carried permissions associated with financial regulators, who can review information submitted by multiple institutions. Ordinary financial companies, by comparison, can access only their own records.
Investigators are examining how the fraudulent account received those permissions and whether the authentication exception was properly managed.
The exposed material included approximately 200 administrative forms, more than 300 personal information records and roughly 350 system user records containing partially masked names and phone numbers.
Most of the affected personal information belonged to employees responsible for security assessments at financial institutions.
The institute said the compromised platform did not store sensitive network configurations, vulnerability assessment results or customers’ personal credit information.
South Korea investigates breach affecting dozens of financial firms
Following the discovery, the institute reported the incident to the Financial Services Commission and the Korea Internet & Security Agency.
The affected financial companies were individually notified, while the institute began preparations to inform employees whose personal information had been exposed.
Authorities launched an investigation into the attack, with police receiving technical information, including IP addresses associated with the intrusion, on November 10.
Financial regulators began an on-site inspection the following day to examine the institute’s security arrangements and determine how the attackers obtained access.
The institute has said it will review its security management procedures and provide compensation if additional damage results from the exposed information.
The incident follows several cybersecurity problems across South Korea’s financial industry, including attacks involving cryptocurrency exchanges.
In October, regulators identified security incidents at 16 financial institutions, including two cryptocurrency businesses, while approximately 100,000 customer records were reported exposed.
An industrywide review subsequently identified security weaknesses at 130 of the 555 financial companies examined.
Bithumb and GOPAX faced separate security incidents
The latest attack follows an October 27 incident at Bithumb, where an unauthorized party accessed the cryptocurrency exchange’s internal mobile groupware system used for employee communications.
As crypto.news previously reported, Bithumb confirmed that employee information had been exposed and began investigating whether customer records were included.
The exchange maintained that the compromised system operated separately from its trading infrastructure and could not be used to access customer cryptocurrency holdings.
During the same period, Daishin Securities disclosed that personal and credit information belonging to 38,490 customers had been exposed, while Mirae Asset Global Investments reported unauthorized access to certain systems.
More recently, South Korean exchange GOPAX suspended trading and withdrawals on November 6 after receiving an email threatening a cyberattack.
GOPAX said it had not detected an actual intrusion or cryptocurrency theft when the restrictions were introduced.
The Financial Services Commission had separately instructed domestic cryptocurrency exchanges to strengthen administrator access controls, withdrawal approval procedures and transaction monitoring following the October 29 Binance hack.
Under South Korea’s existing rules, exchanges must maintain at least 80% of customer cryptocurrency assets in cold storage.
At the end of September, Bithumb held 94.76% of customer assets offline, while GOPAX reported a ratio of 80.54%.
