South Korean financial institute breach exposes records from 40-plus firms

Attackers reportedly posed as an official from the Financial Supervisory Service (FSS) and exploited an authentication weakness to enter the institute’s Continuous Evaluation Support System, where financial companies submit documents for security assessments. Investigators say a temporary access page, intended for cases when SMS authentication was unavailable, lacked the usual verification. The account used in the intrusion appeared to have regulator-level permissions, which can provide access to submissions from multiple institutions; ordinary company accounts are limited to their own records.

The compromised material included about 200 administrative forms, more than 300 personal information records and roughly 350 system user records with partially masked names and phone numbers. Preliminary findings put the number of personal records at about 300, mainly belonging to financial institution employees responsible for security assessments. The institute said the platform did not hold sensitive network configurations, vulnerability assessment results or customers’ personal credit information. According to a report by Chosun Daily, the attackers used more than 100 IP addresses. The institute blocked access to the affected system after discovering the breach.

The institute reported the incident to the Financial Services Commission and the Korea Internet & Security Agency. Police received technical information, including associated IP addresses, on November 10, and regulators began an on-site inspection the following day. Investigators are examining how the fraudulent account gained its permissions and whether the authentication exception was properly managed. The institute said it would review its security procedures and provide compensation if further damage emerged.

The incident follows Bithumb’s October 27 disclosure that an unauthorized party accessed its internal mobile groupware system. The exchange said employee information was exposed and was investigating whether customer records were affected; it said the system was separate from trading infrastructure and customer crypto holdings. GOPAX suspended trading and withdrawals on November 6 after receiving a cyberattack threat, but said it had detected no intrusion or theft. In October, regulators identified security incidents at 16 financial institutions, while a wider review found weaknesses at 130 of 555 companies examined.