Ransomware crimes surge again ... police make “zero” arrests this year

[Financial News] Ransomware crimes targeting South Korean companies and financial institutions are on the rise again, but police made no arrests this year. Cases in which investigations are suspended are also mounting, as the use of overseas servers makes it difficult to track suspects and cooperate internationally.
On the 25th, according to data submitted by the National Police Agency to Yang Bu-nam, a Democratic Party of Korea lawmaker on the National Assembly’s Security and Public Administration Committee, 329 ransomware crimes occurred from 2021 through August this year. Police made just 19 arrests over the same period.
Ransomware crimes have been on the rise again this year in particular. The 33 cases that occurred from January through August this year have already exceeded last year’s full-year total of 32. By contrast, police made not a single arrest over the same period.
Arrests by year were recorded as follows: 12 in 2021, 3 in 2022, 2 in 2023, 0 in 2024, 2 in 2025, and 0 from January through August 2026. Since 2022, the annual number of arrests has not exceeded three.
Cases in which investigations are suspended have also been mounting. Over the same period, police suspended investigations into a total of 183 ransomware crimes. The annual figures were 33 in 2021, 52 in 2022, 39 in 2023, 22 in 2024, 18 in 2025, and 19 from January through August 2026. In just eight months this year, the number of suspended investigations has exceeded last year’s full-year total.
Ransomware is malicious software that encrypts data stored on computers or disables systems, then demands money in exchange for restoring them. Because criminal groups often use overseas servers or operate abroad, identifying suspects and securing evidence can be difficult.
Police said that investigations into ransomware crimes involving overseas servers are often suspended because international cooperation takes considerable time. Suspending an investigation is a procedure for temporarily halting it on grounds specified by regulations, such as when a suspect’s whereabouts cannot be confirmed or it is difficult to secure evidence.
In some cases, it has taken years to apprehend overseas criminal groups. The Gyeonggi Nambu Provincial Police Agency announced in April that it had apprehended the leader of a Kazakhstan-based ransomware group. The case took about three years from the initial report in September 2022 to the group leader’s arrest there in July last year. Using IP addresses obtained from the affected servers, police pursued mutual legal assistance and held video conferences to identify the suspect.
Police had earlier investigated the Clop ransomware case, in which 720 key systems belonging to four universities and companies in South Korea were disabled and Bitcoin was extorted. In 2021, they also arrested four members of the group, including its money-laundering ringleader.
Meanwhile, ransomware attacks are spreading to the financial and medical sectors. In April, Baro Savings Bank suffered a leak of information about its executives and employees following an attack by the ransomware group INC Ransom. In January, Jeonnam National University Hospital and Kangwon National University Hospital were hit by ransomware attacks, disrupting the operation of their medical imaging systems.
Financial authorities said on the 14th that hacking incidents had been confirmed at 16 financial companies and that the scale of information leakage was about 100,000 records.
[email protected] Lee Dong-hyuk Reporter