Seoul Serious Crime Investigation Agency opts not to open probe into AI hacking at financial institutions, notifies police

[Financial News] The Serious Crime Investigation Agency (SCIA) decided not to launch its own investigation into the AI hacking case involving financial institutions, just two days after receiving a notification from police that they had become aware of it.
It judged that it was appropriate for the existing investigative agency to continue the investigation, given that the police investigation had made considerable progress and international cooperation with relevant overseas agencies was also underway.
The Seoul Regional Serious Crime Investigation Agency said on the 23rd that it had notified police it would not open an investigation into the AI hacking case involving financial institutions, which police had reported to it on the 21st.
The Seoul Serious Crime Investigation Agency said, “We reviewed the details of the case and the progress of the investigation,” and explained, “Police began investigating this case before the SCIA opened, and, given that the investigation has made considerable progress and international cooperation with relevant overseas agencies is underway, we judged that it was appropriate for police to continue the investigation.”
The case concerns a series of AI hacking incidents that have recently occurred at financial institutions, including Shinhan Bank, KB Kookmin Bank and Hana Bank.
Police reported the case to the SCIA on the 21st, believing it could constitute a serious crime under the Serious Crimes Investigation Agency Act. Police had earlier sought an authoritative interpretation from the Financial Services Commission and reportedly received a response indicating that the systems of the affected financial institutions could qualify as electronic financial infrastructure facilities under the Electronic Financial Transactions Act.
Under the Serious Crimes Investigation Agency Act and its enforcement decree, police must immediately notify the SCIA when they become aware of a serious crime. After reviewing the details of a case, the SCIA must respond within seven days of receiving the notification, stating whether it will launch its own investigation or have the existing investigative agency continue the investigation.
Cybercrimes that police must report to the SCIA include cases involving violations of the Act on Promotion of Information and Communications Network Utilization and Information Protection resulting from hacking of national critical infrastructure, and violations of the Electronic Financial Transactions Act resulting from hacking of electronic financial infrastructure facilities, among others.
 



[email protected] Choi Eun-sol Reporter