Attackers unknown in 16 of 18 suspected overseas hacks on financial firms since 2024
In short
Of 18 suspected overseas-origin hacking incidents at financial companies from 2024 to October 8, the attacker was identified in only two, according to Financial Supervisory Service data obtained by People Power Party lawmaker Song Eon-seok (송언석). The two identified cases were the GUNRA ransomware attack on Seoul Guarantee Insurance last year and the INC Ransom case at Baro Savings Bank (바로저축은행) in April this year. The regulator said tracing attackers from IP location alone is practically impossible because they alter IPs or connect through VPNs.
Read the full story 2 min read
The attacker was identified in only 2 of 18 suspected overseas-origin hacking incidents at financial companies from 2024 to October 8, according to Financial Supervisory Service (FSS) data obtained by Song Eon-seok (송언석), a People Power Party member of the National Assembly's National Policy Committee. Yonhap, Electronic Times, Maeil Business and Kyunghyang Shinmun reported the data on October 9. Yonhap and Kyunghyang said the period covers about two years and nine months. [ 1 , 2 , 3 , 4 ]
The Seoul Guarantee Insurance hack in July last year was confirmed as the work of the international ransomware group GUNRA. Its servers were infected, services were halted for about 64 hours and the insurer paid customers 11.91 million won in compensation, Yonhap and Kyunghyang reported. In the Baro Savings Bank (바로저축은행) breach in April this year, the ransomware group INC Ransom directly demanded payment, which identified the attacker. [ 1 , 2 , 3 , 4 ]
Of the remaining 16 cases, 13 were estimated to involve overseas IP addresses through domain lookups, in-house security equipment and incident investigations, and 3 were classified as 'overseas country unknown'. Yonhap reported that suspected China-origin incidents included Lotte Card's leak of data on about 2.97 million customers last year and incidents at SC First Bank and KB Life the same year, with other attacks suspected from places including the United States, Bulgaria, Vietnam, Japan, Hong Kong, Taiwan and the United Kingdom. Yonhap noted that an overseas IP does not make it possible to pin down the actual attacker or country. [ 1 , 3 , 4 ]
The FSS said attackers mostly alter IPs or connect through VPNs, so identifying them from IP location is practically impossible. Yonhap reported that the FSS recently shared 28 attack IPs, excluding duplicates, with the financial sector and warned they should be interpreted with care. [ 1 , 3 , 4 ]
Among electronic financial firms and online investment-linked lenders, the attacker was identified in 1 of 12 overseas-origin incidents: a 2024 DDoS attack on Eksimbei (엑심베이), which received a warning email in the name of the hacker group 'Alpha Jackals'. Koem Peimeonchu (코엠페이먼츠), described by Kyunghyang as a payment gateway, was hacked through a security vulnerability in late August; the attacker contacted the company, but its country was only estimated to be China. [ 1 , 2 , 3 , 4 ]
Police are tracking the attacker in the recent financial-sector hacks. CrowdStrike pointed to a 26-year-old living in Guangdong, China, based on clues in Claude Code conversation logs from the attacker's server. Kyunghyang reported that CrowdStrike made the finding on October 7 and that the person told the paper that someone had framed him; Yonhap and Maeil reported that he denied involvement. [ 1 , 3 , 4 ]
Song said building an AI-based defence system is urgent and that developing technology to trace attack paths and identify real attackers is important. As of October 6, no breaches had occurred in the current incidents beyond seven firms: Shinhan, KB Kookmin, Hana and BNK Busan banks, Yegaram and Welcome savings banks, and Hyundai Capital. [ 1 , 2 , 3 , 4 ]
Why it matters
The data show that regulators and financial companies can rarely name who is behind overseas-origin attacks, which outlets linked to IP spoofing and VPN use. Lawmaker Song said an AI-based defence system and technology to trace attack paths are urgently needed, as outlets reported that hacking using AI agents is increasing.
Key facts
- From 2024 to October 8, financial companies had 18 suspected overseas-origin hacking incidents; the attacker was identified in 2. [ 1 , 2 , 3 , 4 ]
- Seoul Guarantee Insurance's hack in July last year was attributed to the international ransomware group GUNRA; services were halted for about 64 hours and the insurer paid customers 11.91 million won in compensation. [ 1 , 4 ]
- In the Baro Savings Bank breach in April this year, the ransomware group INC Ransom directly demanded payment, identifying itself. [ 1 , 2 , 3 , 4 ]
- Of the other 16 cases, 13 were estimated to involve overseas IP addresses and 3 were classified as 'overseas country unknown'. [ 1 , 3 , 4 ]
- Among electronic financial firms and online investment-linked lenders, 1 of 12 overseas-origin hacking incidents had an identified attacker: a 2024 DDoS attack on Eksimbei (엑심베이) preceded by a warning email in the name of 'Alpha Jackals'. [ 1 , 2 , 3 ]
- CrowdStrike suggested the attacker behind recent financial-sector hacks may be a 26-year-old living in Guangdong, China, based on clues in Claude Code conversation logs from the attacker's server; the person has denied involvement. [ 1 , 3 , 4 ]
- As of October 6, no breaches beyond seven firms (Shinhan, KB Kookmin, Hana and BNK Busan banks, Yegaram and Welcome savings banks, and Hyundai Capital) had occurred in the current financial-sector incidents. [ 1 ]
Confirmed by several sources
- Only 2 of 18 suspected overseas-origin hacking incidents at financial companies since 2024 had an identified attacker, according to FSS data submitted to lawmaker Song Eon-seok. [ 1 , 2 , 3 , 4 ]
- The identified cases were GUNRA's attack on Seoul Guarantee Insurance in July last year and INC Ransom's case at Baro Savings Bank in April this year. [ 1 , 2 , 3 , 4 ]
- The FSS said attackers mostly alter IPs or connect via VPNs, making identification from IP location practically impossible. [ 1 , 3 , 4 ]
- In e-finance and online investment-linked finance, only 1 of 12 overseas-origin incidents had an identified attacker, the Alpha Jackals DDoS warning to Eksimbei in 2024. [ 1 , 2 , 3 ]
- CrowdStrike pointed to a 26-year-old in Guangdong, China, using Claude Code conversation logs, and the person denied involvement. [ 1 , 3 , 4 ]
- No financial firms beyond the seven named companies were affected in the current breaches. [ 1 , 2 ]
Still unclear
- Who is behind the recent financial-sector hacks. Police are still tracking the attacker; CrowdStrike's finding is an estimate and the named person denies it. Kyunghyang wrote that CrowdStrike identified the person, while Yonhap and Maeil described it as a possibility.
- Which countries the 13 IP-traced attacks actually came from. Yonhap noted that an overseas IP does not make it possible to pin down the actual attacker or its country, and the FSS warned about bypass connections.
- Who attacked Koem Peimeonchu (코엠페이먼츠) in late August. The attacker contacted the company, but the country was only estimated to be China.
What local media are saying
Timeline, local time
- Yonhap reports that the attacker was identified in only 2 of 18 suspected overseas-origin hacks on financial companies. [ 1 ]
- Electronic Times reports the figures, focusing on limits in tracing attackers. [ 2 ]
- Maeil Business reports the data and CrowdStrike's estimate about the attacker. [ 3 ]
- Kyunghyang Shinmun publishes the figures with the named person's denial given in an interview. [ 4 ]