Over 130 files from 48 companies were leaked due to Geumbowon hacking... Request an investigation to the police

It was confirmed that the Financial Security Institute requested the police to conduct an Internet address (IP) tracking investigation in relation to the hacking incident.

The hacker is said to have accessed the system by impersonating the Financial Supervisory Service. Since it is different from recent hacking incidents in the financial sector where vulnerabilities were randomly found and attacked, there is also the possibility that the Financial Security Institute was targeted.

According to the financial sector on the 11th, the Financial Security Institute was contacted by the police after reports of a hacking incident the previous day and requested an investigation, and the Seoul Metropolitan Police Agency Cyber ​​Investigation Unit began a related investigation.

It is said that there is talk of the possibility that this attack was aimed at the Financial Security Institute.

An official from the Financial Security Institute explained, “Other financial company attacks were conducted by randomly finding vulnerabilities and hacking, but this one was different.”

It is said that hackers exploited a vulnerability in the Financial Security Service's authority approval system to create a false ID with the authority of the Financial Supervisory Service, accessed the site, and then viewed and downloaded data.

During the hacking attack, hundreds of IPs were changed to access the site, making it difficult to detect abnormal access.

Then, when the attack was concentrated around 1-2 PM on the 9th, it was reported that the Financial Security Institute recognized it and blocked access to the system.

It was discovered that although hackers created a false account for the Financial Supervisory Service, actual Financial Supervisory Service account information was not leaked or used in this process.

The Financial Services Commission and the Financial Supervisory Service have been deploying personnel to the Financial Security Institute site since this morning to inspect the status of information protection level management. It is said that they are also looking into when hackers impersonating the Financial Supervisory Service began their attacks.

It is estimated that about 130 files from 48 companies have been leaked so far.

The leaked files are said to include about 200 administrative forms, including samples of personal credit information consent forms, about 300 pieces of personal information such as names and dates of birth included in administrative forms, and about 350 pieces of system user information, such as names and mobile phone numbers that have been masked.

It was found that large companies were not included in the damaged financial companies.

The Financial Security Institute detected abnormal access on the 'Information Protection Regular Evaluation Site', where financial companies submit data necessary for evaluation, and blocked the service at 2:19 pm on the 9th. Currently, the service remains blocked to prevent further damage and investigate the accident.

Meanwhile, the Financial Security Institute completely canceled the 'Financial Information Security Conference (FISCON) 2026' VIP event scheduled to be held on the 12th due to this hacking incident.