Financial Security Institute loses face ... hacked despite having 50 white-hat hackers

Concerns across the financial sector are growing as the Financial Security Institute, which supports security systems throughout the industry, has been exposed to a cyberattack. Anxiety is spreading, particularly among small and midsize financial companies, after even the FSI, which has 50 world-class white-hat hackers, suffered an information leak in a hack. Calls for accountability over the FSI's lax security system are also emerging.
According to the FSI, the attack occurred at around 3 p.m. on the 9th in the financial firms' ongoing assessment system. The institute confirmed an information leak caused by abnormal external access. It immediately took emergency measures, including blocking access to the system, but some information was leaked externally. The information confirmed leaked so far comprises about 200 administrative forms, including sample consent forms for personal credit information; around 300 records of personal information, such as names and birth dates included in the forms; and about 350 records of system user information, including masked names, masked mobile phone numbers and email addresses. About 130 files from 48 companies are reportedly among the leaked material.
The FSI said, "Most of the leaked material consists of administrative forms, such as records of promotional event information being sent and consent forms. Security information, including financial companies' system diagrams, and customers' sensitive information, such as resident registration numbers and personal credit information, were not leaked."
The FSI said the method used in this hack was the same as that used in recent attacks on financial companies. He said, "Rather than targeting the FSI's internal network, the attacker tried to hack a site accessible to the general public or employees of financial companies by posing as someone with authorization."
A senior FSI official said, "It wasn't sensitive information that was stolen," but added, "As the institute's key personnel—the so-called aces—were concentrated in its dedicated penetration-testing unit, the RED IRIS Office, it seems our capacity to protect the FSI was relatively lacking." The official continued, "The attack may have been carried out by someone who knows the FSI's systems well. It may have stemmed less from a desire for money than from a desire to boast about breaching the FSI," and noted, "It is also possible that the attack took place in South Korea."
The FSI asked police to trace the IP address used in the cyberattack. Some analysts say that if a hacker active in South Korea carried out the attack domestically to boast about hacking the FSI—which has the country's top-tier security personnel and equipment—it may be possible to identify the perpetrator. A security industry official said, "Regardless of IP obfuscation, if the attacker is overseas, catching them in a short period of time is virtually impossible. But if the attack took place in South Korea and the attacker is still here, they may be caught."
An FSI official added, "We take this incident very seriously and will do our utmost to restore trust."
[email protected] Park Mun-su Reporter