Hacking IP from Korean bank breaches also probed Kakao Bank, K Bank and Toss Bank
In short
Internet addresses used in recent hacking attacks on South Korean banks and financial companies were also used to attempt access to the servers of internet-only lenders Kakao Bank, K Bank and Toss Bank, Yonhap and Maeil Business reported. The three banks detected and blocked the attempts, and no customer data leaks or other damage have been confirmed. Financial authorities shared the attacker IPs with financial firms and ordered checks after earlier breaches at several commercial and savings banks and a capital company.
Read the full story 1 min read
Internet protocol addresses used in recent hacking attacks on South Korean financial companies were also used to attempt access to the servers of the internet-only banks Kakao Bank, K Bank and Toss Bank, according to Yonhap and Maeil Business. The two outlets, citing the financial industry, reported that no damage has been confirmed at the three banks from those attempts. [ 1 , 2 ]
The checks followed hacking damage at Shinhan, KB Kookmin, Hana and BNK Busan banks, Yegaram and Welcome savings banks, and Hyundai Capital. Financial authorities shared the IP addresses used in those attacks with financial firms and instructed them to inspect their systems, and the attempts on the three internet-only banks were identified in that process. [ 1 , 2 ]
Kakao Bank recorded multiple access attempts from the IP starting in January this year, which the bank's security system detected and blocked. Yonhap reported that no further attacks or damage have followed so far. K Bank also recorded access attempts from the same IP, with no resulting damage, while Toss Bank recorded about 10 attempts between January and August this year; the bank blocked them, and no personal information leak or other infringement occurred, according to the reports. [ 1 , 2 ]
A financial-sector official told Yonhap that attackers typically probe an unspecified number of institutions to check for vulnerabilities and then carry out further attacks if a weakness is confirmed or left unblocked. Neither outlet identified the attackers, and neither gave figures for the scale of the earlier breaches at the commercial, savings and capital companies. [ 1 ]
Why it matters
The disclosure extends a financial-sector hacking case beyond the banks already known to be affected, showing that internet-only banks were also probed. Both outlets say no damage occurred at the three online banks, so the main consequence so far is heightened scrutiny of shared security weaknesses and the official response. The documents do not identify the attackers or say whether further attempts are expected.
Key facts
- Internet protocol addresses used in recent hacking attacks on South Korean financial companies were also used to attempt access to Kakao Bank, K Bank and Toss Bank servers, according to the financial industry. [ 1 , 2 ]
- No damage, including customer data leaks, has been confirmed at the three internet-only banks from those access attempts. [ 1 , 2 ]
- Financial authorities shared the attack IPs with financial firms and ordered checks after breaches at Shinhan, KB Kookmin, Hana and BNK Busan banks, Yegaram and Welcome savings banks, and Hyundai Capital. [ 1 , 2 ]
- Kakao Bank saw multiple access attempts from the IP starting in January this year, which its security system detected and blocked. [ 1 , 2 ]
- K Bank recorded access attempts from the same IP, with no resulting damage. [ 1 , 2 ]
- Toss Bank recorded about 10 access attempts between January and August this year, which it blocked, with no personal information leak. [ 1 , 2 ]
Confirmed by several sources
- The same IP addresses linked to recent financial-sector hacks were used in access attempts on Kakao Bank, K Bank and Toss Bank servers. [ 1 , 2 ]
- No damage has been confirmed at the three internet-only banks from those attempts. [ 1 , 2 ]
- Financial authorities shared the attack IPs with financial firms and instructed them to carry out checks, which is how the internet banks were identified. [ 1 , 2 ]
- Earlier hacking damage was reported at Shinhan, KB Kookmin, Hana and BNK Busan banks, Yegaram and Welcome savings banks, and Hyundai Capital. [ 1 , 2 ]
- Toss Bank was targeted about 10 times between January and August this year, and blocked the attempts. [ 1 , 2 ]
- Kakao Bank was targeted multiple times from January this year, and blocked the attempts through its security system. [ 1 , 2 ]
Still unclear
- Who carried out the access attempts and whether they are one actor. Neither document names an attacker, and both attribute the information only to unidentified financial industry sources.
- Whether additional attacks or damage will emerge at the three internet-only banks or elsewhere. Yonhap reports that no further attacks or damage have followed so far, which leaves the outcome open.
- The full scale of the earlier breaches at commercial, savings and capital companies. Both documents list the affected firms but give no figures on data lost or customers affected.