It has been revealed that the personal information of 1,107 individuals has been leaked due to a hacking incident involving corporate insurance agencies (GA).
According to the Financial Supervisory Service on the 20th, the National Intelligence Service confirmed that an unidentified hacker attempted to steal and publish GA's personal information on the 'dark web,' which is not accessible through general search engines, in April.
The investigation found that the hacking incident occurred when a developer from an insurance business support IT company clicked on a malicious code link while using an overseas image sharing site, leading to the leakage of access links (URLs), administrator IDs, and passwords for 14 GA web servers stored on the computer.
As a result, the personal information of 908 individuals was leaked, including 349 customers and 559 employees and agents of Company A. Among them, 128 suffered leakage of credit information that could determine the type of insurance contracts, insurance companies, securities numbers, and premiums that they were enrolled in. The information of 199 customers from Company B was also leaked. However, it has been confirmed that there was no leakage of credit information.
Only one of the remaining 12 GA organizations showed signs of personal information leakage, but the amount of leakage is estimated to be very small. The FSS plans to conduct additional verification of the 12 GAs through the Financial Security Agency, a specialized institution, for accurate assessment.
The FSS plans to install damage counseling centers within insurance companies and GAs to actively consult on damage reports and related system inquiries caused by the leak. They will also require strengthened management of IDs and passwords, security vulnerability checks, and the deletion of unnecessary customer information to prevent further damage.
The FSS urged customers whose personal information has been leaked to change their passwords on financial institutions' websites and apps. An FSS official noted, "To prevent 'smishing' or other scams disguised as notifications of personal information leaks, URLs will not be included in this notification to customers regarding the leak." They also stressed that institutions like the FSS do not request money or app installations under the pretext of resolving personal information leaks, urging people to be cautious and not to comply with such requests.