South Korea’s Financial Security Institute (FSI) disclosed on November 10, 2026, that it had suffered a data breach. The institute said the incident occurred on October 9 and that it detected unauthorized access to its Information Security Continuous Assessment System during internal monitoring at around 3 p.m. on November 9.
FSI said approximately 850 records were involved: about 200 administrative documents, more than 300 personal-information records and more than 350 system-user records. The user information included names, mobile phone numbers and email addresses. According to FSI, the names and phone numbers were masked. An institute official said the cause and actual scope remain under investigation, so the final number of affected records may change.
The institute said the exposed material did not include financial institutions’ system architecture diagrams, South Korean resident registration numbers or personal credit information. It described the documents primarily as administrative material, including promotional-message records and related consent forms. FSI also said the affected system does not collect vulnerability analyses or assessment results and does not process ordinary bank customers’ financial transactions.
After detecting the access, FSI cut off external access to the system, took emergency security measures and reported the incident to the Financial Services Commission and the Korea Internet & Security Agency. The affected website has been temporarily closed. FSI has notified relevant financial institutions and plans to contact people whose personal information was exposed, including guidance on preventing further harm.