[Editorial] After policing others’ homes, did it leave its own front gate open?

The Financial Security Institute, which inspects financial companies’ information-protection practices, has had information leaked from a system it operates itself. It is “like a police station being robbed.” The Financial Security Institute, the agency dedicated to financial security under the Financial Services Commission, said it had detected abnormal external access to its Information Protection Assessment Support System on the 9th and blocked the connection. The breach occurred even though the system had been flagged in a 2022 audit over the security of its access environment. After a string of hacks targeting the financial sector, including domestic commercial banks, major securities firms and virtual-asset exchanges, the breach of a core financial-security institution makes it essential to review the sector’s operational security systems in their entirety.
The attack on the Financial Security Institute is said to have been difficult to block in advance because the attacker repeatedly changed their internet protocol (IP) address and tried to make the attempts appear to be legitimate access. The leaked materials included around 200 administrative forms, such as sample consent forms for personal credit information; around 300 pieces of personal information, including names and dates of birth contained in those forms; and around 350 pieces of user information, including masked names, mobile phone numbers and email addresses. Most of the leaked personal information is believed to belong to employees at financial companies responsible for ongoing assessments. Under the Credit Information Use and Protection Act, the system serves as a channel for financial companies to assess their own practices for protecting personal credit information and submit supporting documents. Around 3,000 companies are subject to assessment this year.
The problem is that the hack was not prevented despite prior warnings. This has led to criticism that the incident could have been avoided and resulted from poor oversight. In audit findings released in February 2022, the Financial Services Commission took issue with financial company staff being able to view supporting documents on their personal computers at home and called for stronger security measures for the access environment. The same audit also called for tighter access controls on a portal using RegTech—technology that applies information and communications technology to automate and streamline internal-control work. An audit last year likewise uncovered a vulnerability in the RegTech portal that allowed people without viewing authorization to access reports. The repeated findings of problems in systems run by the same institution are reason enough to review its entire management framework.
The Financial Security Institute says that security information such as resident registration numbers, customers’ personal credit information and financial companies’ system architecture diagrams was not leaked. It also says the system does not process ordinary customers’ financial transactions. That is a huge relief. But the harm should not be dismissed just because the information did not belong to ordinary customers. The leaked names, dates of birth and email addresses could be exploited in targeted attacks against security staff at financial companies. Since the detailed investigation is not yet complete, the possibility of further leaks cannot be ruled out.
The Financial Services Commission should not leave the matter solely to the Financial Security Institute’s own review, but should have an independent external organization assess all of its operational systems, including the Information Protection Assessment Support System and the RegTech portal. It must also properly verify how the findings of past audits were actually addressed. The Financial Security Institute should promptly determine the cause of the incident and the extent of the damage, and announce measures to prevent further harm and a compensation plan. Having failed to protect even its own house, let alone others’, the institute must use this opportunity to remake itself with an unwavering resolve to undertake a fundamental overhaul.