South Korea’s Financial Security Institute (FSI), the agency tasked with safeguarding the nation’s financial sector, confirmed a cyber‑intrusion that exposed approximately 300 personal records belonging to employees of dozens of financial firms. The breach was discovered on Monday, November 9, 2026, and the institute promptly shut down the affected system while notifying regulators and the impacted companies.

How the attackers gained access

According to both crypto.news and Cryptopolitan, the perpetrators impersonated an official from the Financial Supervisory Service (FSS) and exploited a temporary access page designed for situations where SMS‑based two‑factor authentication was unavailable. This alternative login route bypassed the usual verification steps, allowing the fake FSS account to inherit regulator‑level permissions that can view documents from multiple institutions.

Scope of the data exposed

The compromised platform was the Continuous Evaluation Support System, used by financial companies to submit security‑assessment documents. Investigators identified roughly 200 administrative forms, about 300 personal records containing names and dates of birth, and around 350 system‑user records with partially masked identifiers. Most of the personal data pertained to staff responsible for security reviews at the affected firms, and no customer credit or transaction information was reported as leaked.

Official response and investigation

The institute reported the incident to the Financial Services Commission and the Korea Internet & Security Agency, and police received technical details, including the IP addresses used, on November 10. Regulators launched an on‑site inspection of the FSI’s security arrangements on November 11 to determine how the fraudulent account obtained regulator‑level access. The institute has pledged to review its authentication procedures and to compensate any individuals who suffer further harm from the leak.

What to watch next

Authorities will continue probing the source of the compromised credentials and whether the breach reflects broader vulnerabilities in South Korea’s financial‑sector cyber defenses. Observers will also monitor any subsequent disclosures from cryptocurrency exchanges, such as Bithumb and GOPAX, which have faced separate security incidents this year.

FAQ

What system was targeted in the FSI breach?

The attackers accessed the Continuous Evaluation Support System, an online platform used by financial firms for security assessments.