South Korea's state-run Financial Security Institute (FSI) has reported a data breach after hackers broke into a system it uses to assess the cyber defences of banks and insurers, Yonhap News Agency reported on Tuesday 10 November. The institute, which oversees security and cyberattack prevention for the country's financial industry, detected the breach the previous day and immediately blocked the affected system, officials said.

The stolen data included about 200 administrative forms, such as personal information consent forms, and personal details of around 300 people, including names and dates of birth, Reuters reported, citing Yonhap. Yonhap also reported that about 350 pieces of information linked to users of the system were taken. The leaked information appears to belong to employees of local banks.

How the attackers got in

The hackers targeted the institute's website used to probe the security systems of local banks, according to the reports. Yonhap said the attack involved a hacker who frequently changed internet protocol (IP) addresses to appear as legitimate access, making the intrusion harder to spot. The institute identified that unauthorised external access had prompted the data leak and shut the affected system down.

Regulators notified

The FSI reported the leak to the Financial Services Commission and the Korea Internet & Security Agency (KISA), the state-run internet security body, officials said. The institute is working to establish the exact route of the intrusion and the full scale of the leak, and officials said some information about the security status submitted by financial firms may have been compromised in the breach.

The FSI oversees financial information provided by banks and insurers, and its assessment system holds material submitted by financial firms about their security arrangements. The investigation into how the attackers entered the system is continuing, Yonhap reported.