Banks breached, then savings banks and capital firms... Police conduct preliminary inquiry into financial-sector hacking

[Financial News] As a series of hacking incidents has been confirmed at major commercial banks in South Korea, police are continuing their preliminary investigation. With hacking incidents also occurring in the non-bank financial sector, police say they will verify the related damage without limiting the investigation to specific financial institutions.
According to Financial News reporting on the 4th, the Cyberterror Response Investigation Unit of the National Police Agency began a preliminary investigation on the 2nd into hacking-related cases involving major commercial banks, including Shinhan Bank, KB Kookmin Bank, Hana Bank and BNK Busan Bank.
Police are currently examining the attackers, methods, links between the incidents, the specific extent of the damage and circumstances suggesting criminal activity in each case. Given the seriousness of the matter, most investigators reported to work and continued their inquiries even during the holiday.
Police began their investigation after news broke on the 1st of the hacking incident at Shinhan Bank. KB Kookmin Bank, Hana Bank and BNK Busan Bank were subsequently included after information leaks resulting from hacking were confirmed at those institutions. Shinhan Bank was previously found to have suffered a suspected AI-enabled hacking attack that leaked the personal information of approximately 25,000 customers. Personal information belonging to 119 customers at KB Kookmin Bank and 89 customers at Hana Bank was also leaked. At BNK Busan Bank, circumstances were discovered indicating that the personal information of 11 outsourced development employees had been exposed on a webpage.
As hacking incidents continue in the non-bank financial sector, attention is also focused on the scope of the police investigation. At Yegaram Savings Bank, an unidentified hacker was found to have accessed a server containing customers' personal information on the 30th of last month, with indications that personal information had been leaked. The company estimates that the personal information of approximately 40,000 people was leaked and is working to determine the exact extent of the damage. At Hyundai Capital Services, an attack through an overseas IP address was also found to have leaked the personal information of 146 mortgage loan agents, showing that hacking incidents are spreading beyond the banking sector.
Police have not ruled out investigating damage occurring in the non-bank financial sector and are examining the related information. They also plan to verify the facts if additional damage is confirmed. However, it has not been established whether the hacking incidents in the non-bank financial sector resulted from the same attack as the commercial-bank cases currently under preliminary investigation.
Financial authorities are examining the possibility that AI was used in the successive hacking attacks. In particular, traces of a Chinese-language AI penetration-testing tool were found on some servers believed to have been used in the attacks, raising the possibility that AI was used to automate them. Police, however, say they cannot confirm whether AI was actually used in the attacks. If the police shift from a preliminary investigation to a formal investigation, the case is expected to become the first major cyber incident in which police launch a full-scale investigation since the revised Criminal Procedure Act took effect on the 2nd.


[email protected] Seo Ji-yoon Reporter