“More about showing off than money ... someone who knows the Institute’s systems” ... Financial Security Institute faces blame over hack

[Financial News] Concerns are mounting across the financial industry as the Financial Security Institute, which supports security systems throughout the sector, has been exposed to a cyberattack. Anxiety is spreading, particularly among small and midsize financial firms, after even the Institute—which employs 50 world-class white-hat hackers—suffered a hack that led to information being leaked. Questions are also being raised about who is responsible for the Institute’s lax security systems. 
On the 11th, the Financial Security Institute said the attack took place at around 3 p.m. on the 9th in a system used to conduct ongoing assessments of financial companies. The Institute confirmed that information had been leaked as a result of abnormal external access. It immediately took emergency measures, including blocking access to the system, but some information was leaked outside the organization. The information confirmed to have been leaked so far comprises about 200 administrative forms, including sample consent forms for personal credit information; around 300 items of personal information, such as names and dates of birth included in the forms; and around 350 items of system user information, including masked names, masked mobile phone numbers and email addresses. So far, about 130 files from 48 companies are reported to have been leaked.
The Financial Security Institute explained, “Most of the leaked material consisted of administrative forms, such as records of promotional event information being sent and consent forms. Security information, including financial companies’ system architecture diagrams, and sensitive customer information, such as resident registration numbers and personal credit information, were not leaked.” It also said, “We are notifying affected companies individually and taking steps to prevent secondary harm. If secondary harm occurs, we plan to provide compensation proactively.”
The Financial Security Institute said the hacking method was the same as the one used in recent attacks on financial companies. It said, “Rather than targeting the Institute’s internal network, the attacker tried to hack a site accessible to the general public or financial company employees by pretending to have authorization.” The method of impersonating an ordinary person was reportedly more sophisticated than in previous attacks on the financial sector.
A senior Financial Security Institute official said, “It is not that sensitive information was stolen,” but added, “With the Institute’s core personnel—the so-called aces—concentrated in ‘RED IRIS Office,’ the unit dedicated to simulated hacking, it seems we may have been relatively short on the capability to protect the Institute itself.” The official continued, “This attack may have been carried out by someone who knows the Financial Security Institute’s systems well, and may have stemmed less from a desire for money than from a desire to show off having breached the Institute,” adding, “It is also possible that the attack took place in South Korea.”
The Financial Security Institute asked police to trace the IP address used in the cyberattack. Some analysts say that if the attack was carried out in South Korea by a hacker operating domestically to show off having hacked the Institute—which has the country’s top-level security personnel and equipment—the perpetrator may be identified. A security industry official said, “Regardless of IP routing, if the attacker is overseas, it is virtually impossible to catch them in a short period of time,” adding, “But if the attack took place in South Korea and the attacker is still here, they may be caught.”
A Financial Security Institute official said, “We sincerely apologize for causing concern to financial companies and the public through this incident, despite our responsibility as a specialized financial security institution to maintain a high level of security and trust.” The official added, “We will take this incident seriously and, with a resolve to transform ourselves completely, thoroughly review and improve our entire information protection system and do our utmost to restore trust.”
[email protected] Park Mun-su Reporter