Cyberattack Attempts Surge at South Korea’s State Banks

Cyberattack attempts targeting two of South Korea’s key state-linked financial institutions have risen sharply this year, adding to concerns about the security of the country’s highly connected public and financial systems.

The state-run Export-Import Bank of Korea detected 283 hacking attempts through Oct. 5, according to data submitted to opposition lawmaker Lee Jong-wook. That was nearly eight times the 36 attempts recorded during all of last year and exceeded the combined 197 attempts detected over the preceding five years.

Activity involving harmful internet protocol addresses accounted for 230 of this year’s attempts, up from 19 last year, while attempted access to the bank’s web systems increased to 53 from 17. Of the 283 attempts, 272 originated from overseas IP addresses. The locations of those addresses do not necessarily indicate the nationality or identity of the attackers.

The Export-Import Bank said it had suffered no hacking-related damage, including leaks of personal or credit information, during the past six years. It operates a round-the-clock cybersecurity monitoring center and shares threat information with the finance ministry’s cyber safety center.

The Bank of Korea separately recorded 136 hacking attempts through Oct. 2, roughly 4.5 times the 30 detected in all of last year. Targets have mainly included internet-accessible systems such as the central bank’s main website, economic statistics portal and electronic library. The bank said there were no successful intrusions, service disruptions or data leaks between the beginning of September and Oct. 2.

Earlier incidents show the potential impact of such attacks. A distributed denial-of-service attack intermittently slowed access to the central bank’s website in December 2023. An intrusion into a system run by an outside training provider exposed personal information belonging to 186 Bank of Korea employees in May and June this year.

The figures emerged as South Korea deals with a wider series of breaches. About 25,000 Shinhan Bank customers had personal and credit information exposed after an unauthorized party bypassed authentication on a loan-related service. Similar intrusions have been identified at several other financial institutions, and authorities are examining whether artificial intelligence was used to automate parts of the attacks.

Outside finance, more than 100,000 users of an online public-sector ethics training platform had personal information exposed from an older system retained by a contractor. Cybersecurity specialists have also reported suspected breaches involving two major Seoul churches, prompting investigations into the scale and cause of the incidents.

The expanding range of targets underscores the challenge facing institutions that depend on external service providers and public-facing online systems. While the number of detected attempts does not by itself show successful penetration, the latest disclosures highlight the need for tighter vendor controls, faster removal of legacy data and continuous monitoring across both public and private networks.