The Financial Supervisory Service (금융감독원) is reportedly said by industry sources to have narrowed down 19 IP addresses—addresses assigned to devices connected to the internet—suspected of being used in recent cyberattacks targeting South Korean financial institutions. Several financial companies, including Hana Bank (하나은행), KB Kookmin Bank (KB국민은행) and Shinhan Bank (신한은행), experienced customer data leaks in succession last week, and police launched a formal investigation on the 6th. On Thursday, Shinhan Bank said the names, phone numbers and annual incomes of about 25,000 customers had been leaked.

Background and context

The Financial Supervisory Service is reportedly said to have narrowed down IP addresses suspected of having been used in AI agent-based hacking. However, identifying IP addresses does not by itself establish who carried out the attacks or how the systems were breached. The original report did not provide details of the individual addresses or specify the countries in which each address was identified.

It is also significant that the impact was not limited to one financial company. The original report says several financial companies, including Hana Bank, KB Kookmin Bank and Shinhan Bank, experienced customer data leaks, but it did not disclose the scale of the leak or the types of information involved at companies other than Shinhan Bank. Concerns have been raised that more financial companies may have been affected, and financial companies are checking their own security systems in preparation for further attacks.

The National Office of Investigation of the Korean National Police Agency (경찰청 국가수사본부) said it had formally opened an investigation into the financial-institution hacking incident on suspicion of violating the Act on Promotion of Information and Communications Network Utilization and Information Protection (정보통신망법). After conducting a preliminary inquiry beginning on the 2nd, police assigned the Cyber Terror Investigation Unit (사이버테러수사대) as the dedicated investigative team and plan to deploy 28 officers across four teams. Police have asked the Financial Services Commission (금융위원회) for an authoritative interpretation on whether the compromised systems qualify as electronic financial infrastructure, and are also reviewing whether the matter should be referred to the Major Crimes Investigation Office (중대범죄수사청).

President Lee Jae-myung called for a thorough investigation into the attacks over the weekend. The Financial Supervisory Service’s identification of IP addresses, the police investigation and the financial companies’ security checks are measures focused, respectively, on tracing evidence of the attacks, investigating the incident and preventing further harm. At this stage, none of these measures alone can be taken to have established the full extent of the impact or how the attacks took place.

What this news means

For customers, the first concern is whether their information was leaked and which information was affected. Shinhan Bank’s announcement confirms that the names, phone numbers and annual incomes of about 25,000 people were leaked, but the scale of the impact on customers of other financial companies and the types of information involved have not yet been disclosed. It is therefore important to distinguish the fact that leaks occurred at several financial companies from the extent of the impact on any particular individual.

For financial companies, checking whether their systems were actually breached and determining the scope of the exposed information may be as important as reviewing their systems. Even if authorities have narrowed down the IP addresses, further investigation is needed to establish who the attackers were, how they gained access and whether there was additional harm. Customers will be able to assess the specific impact on them as police investigations and company-by-company reviews of the damage proceed.

For example, customers of a financial company can check whether it has officially notified them that their information was leaked and which items were exposed. However, the information currently available does not provide criteria for determining whether customers of companies other than Shinhan Bank were affected, or specify any separate steps they should take.

What is confirmed and what remains unknown

Confirmed facts

  • Industry sources reportedly say the Financial Supervisory Service narrowed down 19 IP addresses in 12 countries suspected of having been used in recent hacking incidents involving financial institutions.
  • Several financial companies, including Hana Bank, KB Kookmin Bank and Shinhan Bank, experienced customer data leaks last week.
  • Shinhan Bank said the names, phone numbers and annual incomes of about 25,000 customers were leaked.
  • Police have launched a formal investigation on suspicion of violating the Act on Promotion of Information and Communications Network Utilization and Information Protection, and plan to deploy 28 officers across four dedicated investigative teams.
  • Financial companies are checking their own security systems in preparation for further hacking attempts.

What remains unknown

  • What are the specific addresses of the 19 IP addresses, and in which countries was each address identified?
  • Have the parties behind the attacks and the actual routes used to gain access been identified?
  • What types of information were leaked at financial companies other than Shinhan Bank, and how much was affected?
  • It has not yet been determined whether the compromised systems qualify as electronic financial infrastructure or how that determination would affect the subsequent investigative process.

What readers should check

  • Check whether the financial company you use has officially notified customers about whether their information was leaked and which items were exposed. If the information is unclear, you can contact the company directly.
  • Watch for follow-up announcements from the Financial Supervisory Service and police that clarify the IP address findings, investigation results and whether there was additional harm.
  • Until the scope of the impact at each financial company is confirmed, avoid making assumptions about the overall scale of the leaks and check whether any notices apply specifically to you.

References