South Korea’s Financial Security Institute, the dedicated financial security agency under the Financial Services Commission, detected abnormal external access to its information protection continuous evaluation system at about 3 p.m. on November 9 and found that information had leaked, Yonhap reported. The institute blocked access to the system and reported the breach to the commission and to the Korea Internet and Security Agency, and Yonhap said the attacker changed IP addresses frequently while posing as normal access.
About 200 administrative forms were taken, including sample personal credit information consent forms, carrying about 300 items of personal information such as names and dates of birth, most of them belonging to financial company employees responsible for the evaluation process, plus about 350 items of system user information including masked names and mobile phone numbers. An institute official said the leak contained no financial company system diagrams or other security information and no resident registration numbers or sensitive customer credit information, and the institute has notified the affected firms and said it would compensate any secondary damage.