South Korean police expand financial-sector hacking investigation team to 43 people

The National Office of Investigation of South Korea's National Police Agency said in a press explanation on October 9 that it had expanded the dedicated team investigating recent hacking of financial institutions from 28 to 43 people. Newsis and Hankook Ilbo reported that 15 support staff in digital forensics and international cooperation were added, and Kukmin Ilbo and Newsis said the expansion took effect on October 7. According to Newsis, police formed the dedicated team on October 5, citing the seriousness of the case. [ 1 , 3 , 4 , 5 ]

Police said they were investigating closely by securing related data and analysing the affected systems, and were also carrying out international cooperation, including blocking attack servers. Police said that even if the case is later transferred to the Serious Crimes Investigation Agency, they would track the suspects thoroughly until then so that there is no gap in the investigation. [ 1 , 3 , 4 , 5 ]

Yonhap reported that police spoke publicly because attention had turned to whether the case would be transferred to the agency, which launched on October 2. Under the agency's law and its enforcement decree, other investigative bodies that first learn of a case must notify the agency immediately if they judge it a serious crime, and the agency's head can request a transfer regardless of earlier investigation or its progress. Police said they can investigate all cybercrime, the agency takes over once a serious-crime case is transferred, and so confusion over jurisdiction, "case ping-pong" or investigative delays cannot occur. [ 1 , 3 , 4 , 5 ]

Hankook Ilbo reported that cybercrimes police must report to the agency are network act violations from hacking national core infrastructure or Electronic Financial Transactions Act violations from hacking electronic financial infrastructure facilities. Because the affected institutions themselves are not national core infrastructure, police have asked the Financial Services Commission (금융위원회) for an interpretation of whether the hacked systems are electronic financial infrastructure facilities. Newsis reported that police are treating the case as a violation of the Information and Communications Network Act and are reviewing whether it is subject to notification. [ 4 , 5 ]

Police also rejected criticism that their initial investigation was late. They said they opened a preliminary inquiry on October 1, the day of the first media report, quickly secured log records and other data, and set up cooperation with the Financial Security Institute (금융보안원) and other bodies. [ 1 , 3 , 4 , 5 ]

Newsis reported that the hacking caused personal data leaks at Shinhan, KB Kookmin, Hana and BNK Busan banks, Yegaram and Welcome savings banks, and Hyundai Capital. It said police found that many of the 28 IP addresses used in the attacks were "laundering" addresses meant to hide the attackers' real location. [ 4 ]