South Korea’s FSI breach linked to more than 40 firms

More than 40 companies were linked to a breach of South Korea’s Financial Security Institute (FSI), where attackers used a fake Financial Supervisory Service (FSS) account to enter a document-review platform through a backup access page that bypassed SMS verification, according to the FSI.

The intrusion exposed about 200 administrative forms, more than 300 personal records containing names and birth dates, and about 350 user records with partly hidden names and phone numbers. Most affected people were employees who handled security reviews at financial firms.

The FSI discovered the breach on Monday, November 9, shut down the affected system and reported the incident to the Financial Services Commission and the Korea Internet & Security Agency.

The attackers changed more than 100 IP addresses to make their traffic resemble normal activity. Their fake FSS account could see files from many institutions at once; an ordinary company account could open only its own files.

On Tuesday, November 10, police received the attacker’s IP data. Regulators began an on-site check of the FSI’s security the next day. Investigators continued working to determine how the fake account gained legitimate regulator-level access.

No reports so far indicate that customer credit information or transaction records were exposed. The FSI said network diagrams and vulnerability test results remained unaffected. The agency also promised compensation if the leaked information resulted in further harm.

The breach tests a cyber-defense mandate

The affected platform, the Continuous Evaluation Support System, lets financial firms upload documents for security reviews. Roughly 3,000 companies pass through that process each year.

The FSI leads cyber defense for South Korea’s financial industry. Since 2025, it has also operated a digital-asset security team led by an ethical hacker, with a mandate to raise security standards at crypto exchanges.

The incident therefore places the FSI’s identity controls beside the security standards it advises others to adopt. It also directs attention toward privileged access, because the contingency route skipped standard authentication checks.

Korean exchanges have experienced repeated intrusions this year. On October 27, Bithumb reported that an unauthorized party reached its internal mobile groupware system and exposed employee information. Separately, Daishin Securities (KRX: 003540) said compromised data covered 38,490 customers.

Regulators counted more than 4.4 million scanning attempts in a single day, mostly from North Korean IP ranges. An FSI official warned that IP data can be faked or rerouted and “cannot prove who is behind an attack on its own.” That limitation matters as police examine the address data supplied on November 10.

What does this change for banks and crypto exchanges?

For banks and crypto exchanges, the practical change is that emergency login paths and regulator-linked accounts warrant the same scrutiny as ordinary authentication, while custody teams face a stronger case for keeping high-value assets offline.

The wider data reinforces that pressure. In October, the Financial Services Commission said suspected AI-driven attacks had hit 16 firms, including banks, savings banks and crypto businesses. The total rose to 20 by month-end, with about 100,000 records exposed. Inspectors reviewed 555 companies and found security problems at 130, or roughly one in four.

On November 6, Gopax, which Binance owns, halted all trading and transfers and moved customer tokens into offline cold storage. Neither a robbery nor a breach had occurred at Gopax. According to Cryptopolitan, regulators recommended the hot-to-cold wallet change after a series of breaches.

Firms whose reviewers’ identity data appears among the leaked records also need to assess impersonation and social-engineering exposure. The incident does not establish customer-account compromise, but it demonstrates why privileged access cannot remain outside routine authentication and monitoring.

The next enforcement milestones are whether police can identify the attacker from the November 10 IP data and what the November 11 inspection finds. Until authorities resolve how the fake account obtained regulator-level access, emergency-path authentication and offline custody remain the immediate control priorities for banks, exchanges and the regulators reviewing them.