Most Overseas Cyberattacks on Korean Financial Firms Remain Unattributed

South Korean financial companies have struggled to identify who was behind most suspected overseas cyberattacks reported over the past several years, underscoring persistent gaps in attribution as the industry faces a growing threat of data breaches and ransomware disruption.

Financial firms reported 18 hacking incidents believed to have originated abroad between the start of 2024 and Thursday, according to Financial Supervisory Service data disclosed by Rep. Song Eon-seok of the main opposition People Power Party. The attackers were identified in only two of those cases.

One identified case involved Seoul Guarantee Insurance, whose operations were disrupted for 64 hours by the international ransomware group GUNRA in July 2025. The other involved Baro Savings Bank, which was attacked by the group INC Ransom in April this year.

Among the other 16 incidents, 13 were associated with internet protocol addresses believed to be overseas. Authorities could not determine even the apparent country of origin in the remaining three. The overseas addresses included locations in China, the United States, Bulgaria and Vietnam. However, an IP address does not establish an attacker's physical location because malicious actors can route traffic through compromised devices, proxy services and other infrastructure in different countries.

Song called for the rapid development of an artificial intelligence-based defense system and stronger tools for identifying attackers. His comments highlighted a central challenge in cyber investigations: defensive systems may detect suspicious traffic or limit damage without producing reliable evidence about the people or organizations responsible. Concealed or disguised IP addresses make that task especially difficult.

The disclosure comes after a series of hacking incidents affected Hana Bank, KB Kookmin Bank and Shinhan Bank last week, exposing customer information and raising concern that other financial institutions could also be vulnerable. The recent cases focused attention on systems used by employees and sales operations rather than only on banks' central transaction platforms.

For financial institutions, the findings add urgency to investment in threat detection, network monitoring and coordinated incident response. They also point to the need for better information sharing among companies, regulators and law enforcement. Accurate attribution is difficult and often slow, but identifying common infrastructure and attack methods can still help institutions close vulnerabilities and prevent repeat intrusions.

The low identification rate shows that Korea's financial sector faces not only the immediate task of stopping attacks, but also the longer-term challenge of building the technical and investigative capacity needed to understand who is targeting critical financial systems and how those campaigns are evolving.