Yonhap: Financial Security Institute information-protection assessment system hacked, about 300 personal information records of financial institution employees leaked
According to Yonhap News Agency, the Financial Security Institute (FSI), under South Korea’s Financial Services Commission, suffered a hacking attack on its regular information-protection assessment support system, resulting in a data leak. FSI detected unauthorized external access at around 3 p.m. on Monday (November 9), immediately blocked the relevant system, and notified the Financial Services Commission and the Korea Internet & Security Agency (KISA).
The leaked information came from the website FSI uses to conduct security assessments of financial institutions, including about 200 administrative forms, about 300 personal information records contained in the forms (including names and dates of birth), and about 350 pieces of information related to system users. The attacker infiltrated the system by frequently changing IP addresses to disguise normal access. Most of the leaked personal information belonged to employees in charge of ongoing assessment work at financial institutions.
Officials confirmed that no consumers’ personal credit information or resident registration numbers were leaked, and no sensitive core security data such as financial institutions’ system architecture diagrams were leaked either. The system is mainly used to submit administrative materials required for assessments, and does not collect core security information or process ordinary customer transactions. FSI is investigating the cause of the incident and the scope of the damage, and financial regulators have launched an on-site investigation.
Original source:
Title: (LEAD) Financial Security Institute reports data leak following hacking attack Publisher: Yonhap News Agency Publication date: 2026-11-10 URL: https://en.yna.co.kr/view/AEN20261110010651315 Source nature: English report by South Korea’s official news agency Verification status: full text actually read in this case, verification date 2026-11-11; no access restrictions Supporting content: supports that the FSI security assessment system was hacked, about 200 administrative forms, about 300 personal information records including names and dates of birth, about 350 user-related records, repeated IP changes to disguise access, immediate blocking and notification, and no consumer credit information involved
ABAB AI Insight
The Financial Security Institute is the dedicated information-security body for South Korea’s financial industry, responsible for monitoring cyber threats, responding to hacking incidents, and supporting financial institutions’ security assessments. Although the compromised assessment system has so far been confirmed not to have exposed consumer credit data or core security architecture, the fact that the industry’s “gatekeeper” institution itself was breached still raises concerns about the reliability of the sector-wide defense line.
This incident comes after several recent data leaks in South Korea’s financial sector. Yonhap previously reported that since late September, 37 financial institutions have experienced about 40 leakage incidents involving more than 470,000 personal data records. FSI itself being hit as the coordination and assessment body highlights that the assessment platform can also become an attack entry point.
The attack method of frequently changing IP addresses to disguise normal access is a common evasion technique. Regulators have begun an on-site investigation, and FSI has pledged to further review its information-protection management system. The scope of the incident is still being verified, and whether it will expand further requires attention to official updates.
ABAB News · Cognition Law
“about 300” and “about 350” are the currently confirmed figures, and the investigation is still ongoing, so the final scope may change.
Officials clearly stated that no consumer credit information or system architecture diagrams were leaked, which is a different level from the leakage of employee administrative form information.
Immediate shutdown, disconnection from the network, and notification of regulators are response steps; they do not mean the damage has been fully contained or the assessment has ended.