Now Hacked
EN
Data breach

Financial Security Institute hack exposes data from 48 financial firms

First reported · Last reported · 169 related reports

The Financial Security Institute detected a data leak from its continuous information security assessment system at around 3 p.m. on November 9, blocked access, and reported the incident to the Financial Services Commission (FSC) and the Korea Internet & Security Agency (KISA). An estimated 130 or more files from 48 financial firms were leaked, along with approximately 200 administrative forms, more than 300 personal information entries in those forms, and more than 350 system user information records. The attacker bypassed SMS verification to create an account impersonating the Financial Supervisory Service and exploited inadequate access authorization checks in an operational inspection feature. The institute blocked 246 attacking IP addresses, while the FSC launched an on-site inspection and announced a targeted audit.

Key facts

Affected organization
Financial Security Institute
Incident type
Data breach
Occurred / detected
2026-11-09
Scale of damage
An estimated 130 or more files from 48 financial firms leaked, along with approximately 200 administrative forms, more than 300 personal information entries, and more than 350 system user information records
Cause / method
Bypassing SMS verification during registration, creating an account impersonating the Financial Supervisory Service, and exploiting inadequate access authorization checks in an operational inspection feature
Location
South Korea

If your data was exposed

View Financial Security Institute notice ↗

Exposed dataName

  1. Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.
  2. If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Center ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗

Lookup and notice links are official pages found by AI. Make sure the address is on the organization’s official domain before using it.

Timeline

  1. The institute detected the data leak at around 3 p.m., blocked access to the system, and reported the incident to the Financial Services Commission and the Korea Internet & Security Agency.
  2. Details of the leaked administrative forms, personal information, and system user information were announced.
  3. The Financial Services Commission launched an emergency on-site inspection, and the launch of a police investigation was disclosed.
  4. The head of the Financial Security Institute issued a formal apology, and the Financial Services Commission announced that it would begin a targeted audit on the 16th.
  5. The method of data theft, involving the bypass of SMS verification and inadequate access authorization checks, was revealed, and the blocking of 246 attacking IP addresses was completed.

169 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.