FSI faces scrutiny over lax website security after data breach

Detailed summary

South Korea’s Financial Security Institute, the financial sector’s cybersecurity agency, suffered a data breach that exposed about 850 records, including personal information of…

South Korea’s Financial Security Institute, the financial sector’s cybersecurity agency, suffered a data breach that exposed about 850 records, including personal information of employees at 48 financial companies and administrative documents.

The FSI said Wednesday that the breach occurred Monday at its continuous assessment support system, a website that collects documents from financial companies for regulatory assessments.

Hackers reportedly accessed the system using fraudulent accounts while impersonating the Financial Supervisory Service, the institute said.

No security-sensitive information, such as financial companies’ system architecture diagrams, or sensitive personal data, including resident registration numbers and personal credit information, was compromised, it said.

Financial authorities launched an on-site investigation Wednesday to determine the full extent of the breach and how it occurred. The incident has raised concerns over the institute’s ability to protect the financial sector from cyber threats.

The investigation has also brought scrutiny to the institute’s oversight of its other websites. A report on the Financial Services Commission’s comprehensive audit of the FSI last year identified security vulnerabilities in its RegTech Portal, a separate website that provides regulatory reporting information and handles inquiries from financial companies.

The audit found that unauthorized users could access certain pages on the portal. The FSC urged the institute to inspect its other websites to ensure similar vulnerabilities did not exist.

Opening of the article, excerpted from Pulse (Maeil Business). To read the rest, open the article on the publisher's site.