Threat watch / Breach
South Korea's Financial Security Institute hacked: files from 48 financial firms leaked from its evaluation site
On November 9, 2026, attackers reached the online system that South Korea's Financial Security Institute (FSI), the body in charge of cybersecurity for the financial sector, uses to collect financial firms' security self-assessments. Korean media report that they posed as a user with the privileges of the Financial Supervisory Service. The FSI says employees' names, dates of birth and masked phone numbers leaked, but no system diagrams, resident registration numbers or customer credit data. Police are investigating; no attacker has been named.
- Sector
- Finance
- Way in
- Software flaw
- Product or vendor
- None named
- How it happened
- Through the FSI's continuous security evaluation website, where financial firms submit documents. According to JKN, the attackers exploited a flaw in the site's authorization approval system to create a fake ID that appeared to have Financial Supervisory Service privileges, while constantly changing IP addresses; JKN says there is no sign that a real FSS account was leaked or used. SBS also reports that they impersonated the FSS. The FSI told FNN the method was the same as in recent attacks on financial companies.[1][3][4][5] Checked 11 Nov 2026
- What was stolen
- About 130 files from 48 financial companies, according to JKN and FNN: about 200 administrative documents, about 300 personal records (names and dates of birth, mostly of employees in charge of the evaluations) and about 350 system user records (masked names, masked phone numbers, emails). The FSI says no system architecture diagrams, resident registration numbers or personal credit data leaked. SBS later reported that the system also held configuration diagrams and parts of vulnerability assessments of major financial firms, and that the FSI says their leak was stopped by shutting the system.[1][2][3][4][5] Checked 11 Nov 2026
- Who was impacted
- 48 financial companies, none of them large according to JKN, and their employees who handle the security evaluations. The FSI says it will compensate any secondary damage.[1][2][3][4] Checked 11 Nov 2026
- Threat actor
- Not attributed
Timeline
- The FSI detects the attack on its evaluation site around 3 p.m. and blocks access, according to SBS, NOCUTNEWS and FNN; JKN says the attack intensified between 1 and 2 p.m. and the site was blocked at about 2:19 p.m. SBS says the FSI reported it to the Financial Services Commission and the Korea Internet & Security Agency. [1][2][3][4]
- The FSI asks police to trace the IP addresses; the Seoul Metropolitan Police Agency's cyber investigation unit opens an investigation, according to JKN. No suspect has been identified. [3][4][5]
- FSC and FSS staff are sent to the FSI to inspect its security, according to JKN, and its FISCON 2026 VIP event planned for November 12 is cancelled. A senior FSI official tells FNN the attack may have come from "someone who knows the FSI's systems well"; no group or country is named. [3][4]