South Korea links one attacker IP to breaches at seven financial firms

  • South Korea activated an emergency KISA response to contain cyberattack risks beyond financial firms.
  • KISA sent security inspection advisories to about 28,000 companies with registered CISOs.
  • C-TAS shares malware, attacker IP addresses and threat trends with about 5,900 member companies.

South Korea has expanded its response to a series of financial-sector breaches by activating an emergency cyber-response system with the Korea Internet & Security Agency to prevent similar attacks from reaching private companies outside finance. Authorities had linked one internet protocol address and similar attack methods to breaches targeting Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital, while customer-facing internet and mobile banking remained unaffected and no financial losses had been confirmed by October 4. The Ministry of Science and ICT and KISA increased staffing at KISA's Internet Security Incident Response Center, strengthened monitoring of major corporate websites and placed response teams on standby for immediate deployment. The ministry also issued security-check advisories to about 28,000 companies with registered Chief Information Security Officers, shared threat data through Protection Country and C-TAS, and asked relevant cloud providers to block malicious activity linked to overseas attacker IP addresses identified by the Financial Security Institute. Financial regulators continue to investigate the financial-sector incidents, while KISA has prepared experts for dispatch at the request of the Financial Services Commission and Financial Supervisory Service.

The information on this website is generated using AI and we cannot guarantee its accuracy. Please use it as reference information only.