South Korea's financial security institute reports breach of assessment system

What the institute found

South Korea's Financial Security Institute, the public agency that audits the cybersecurity of banks and brokerages, detected unauthorised external access on 9 November 2026 in the system where financial firms submit their assessment forms. Technicians shut the site at 14:19 Seoul time and reported the incident to the Financial Services Commission (FSC) and to the KISA agency.

The institute is not a bank or a brokerage. It is the technical body that finds vulnerabilities in financial firms' systems and monitors threats, and it investigates breaches when they happen. The compromised server was the continuous-assessment channel through which institutions upload the forms behind the audit, from credit-information consent models to compliance documentation.

The official count

As of 11 November the institute counted about 200 administrative forms, more than 300 personal records inside them with names and dates of birth, and slightly more than 350 user records with partially masked mobile numbers. Most of the personal data belongs to employees of the institutions who handled the assessments, not to customers.

The 48 affected institutions are regional agricultural cooperatives and credit unions, with at least one forestry cooperative. No large commercial bank appears in the count. The institute evaluates about 3,000 institutions this year and said the affected platform is an external document-exchange channel, not its internal network. It also said the system does not process retail customer transactions and that resident registration numbers did not appear in the leaked material.

The institute said it contacted affected parties by telephone, institution by institution, from the night of 10 November.

A revised account

In its first version the institute said the compromised server held neither vulnerability analyses nor architecture diagrams. A later account dated 12 November broke that reading: the attacked server did hold security information, including configuration diagrams of large domestic financial institutions' systems and parts of vulnerability assessments.

The institute acknowledged the data was there and said it did not leave because the machine was switched off early in the attack. The real scope of the breach is not closed, the institute says, because its investigation continues.

How the attacker got in

A later analysis describes a fake account with the same privileges as the Financial Supervisory Service (FSS), created by exploiting a flaw in the institute's authorisation process. No real FSS account was compromised, according to that account. The 236 IP addresses used in the attack are all South Korean and none matches earlier intrusion attempts, the same report says.

Kwak Jin, a cybersecurity professor at Ajou University, compared the risk to leaving a house's floor plan in view, because it shows where to enter and which server to hit.

Investigations and timing

The Seoul Metropolitan Police opened an investigation in its cybercrime unit at the institute's request. The FSC sent an inspection team to the institute's headquarters on Wednesday 11 November, with FSS staff assisting.

Four days before the breach, on 5 November, FSC chairman Lee Eog-weon had gathered industry representatives at the institute's own headquarters to press them on cybersecurity. He said his office would hold chief executives legally accountable for serious management failures and would not tolerate practices that worsen an incident's impact, such as neglecting known risks or relying on superficial inspections.

There is no indication that the attacker reacted to that meeting or that the breach stems from the weaknesses raised there. The institute has not said when its investigation will conclude.