South Korean Police Form 28-Member Team to Probe Financial Cyberattacks

South Korean police have opened a formal investigation into a series of cyberattacks that caused customer information leaks at several major financial institutions, adding a criminal inquiry to the government’s broader response to the breaches.

The National Office of Investigation said Tuesday that it had assembled a 28-member team to investigate suspected violations of the information and communications network law. The institutions affected by the recent attacks include Hana Bank, KB Kookmin Bank and Shinhan Bank.

Investigators are also considering whether to transfer the case to the newly established Serious Crime Investigation Agency. That agency has jurisdiction over cybercrimes targeting key state facilities and attacks on electronic financial infrastructure, making the decision over a possible referral significant for how the inquiry will proceed.

The National Office of Investigation said it would conduct the investigation swiftly and strictly while coordinating closely with other relevant agencies. The stated aim is not only to establish responsibility for the attacks but also to address public concern following the back-to-back disclosures of customer information.

The launch of a dedicated police team marks a new stage in the official response. Authorities must now determine the methods used to enter the affected systems, whether the incidents were connected and who was responsible. Those findings will also be important for assessing whether weaknesses were limited to particular companies or reflected a wider vulnerability across financial-sector infrastructure.

The case has drawn heightened attention because banks hold extensive personal and financial information, while compromised customer data can create risks beyond the initial intrusion. Even when payment systems are not directly breached, personal details obtained in an attack may increase exposure to follow-on fraud attempts and other forms of abuse.

The investigation will unfold alongside security checks and protective measures by financial regulators and the companies involved. For the affected institutions, the immediate tasks include securing systems, identifying the full scope of exposed information and informing customers about any necessary precautions.

The potential involvement of the Serious Crime Investigation Agency also gives the case an early test of South Korea’s reorganized investigative framework. A referral would place the inquiry within the mandate created for serious attacks on nationally important digital and financial systems. Until investigators complete their initial review, officials have not announced a final decision on which agency will lead the case through its later stages.