Police have formally opened an investigation into a recent hacking incident involving a financial institution on suspicion of violating the Information and Communications Network Act. The National Police Agency’s National Office of Investigation (경찰청 국가수사본부) said October 6, 2026, that it had confirmed the objective facts and moved the case into the investigation phase. It designated the Cyber Terrorism Investigation Unit (사이버테러수사대) as the dedicated investigative team and assigned four teams totaling 28 members, led by the head of the Cyber Terrorism Response Division (사이버테러대응과). Alongside the investigation, police are considering whether the legal classification of the breached system means the case should be reported to the Serious Crimes Investigation Agency (중대범죄수사청, 중수청).

Background and context

Police had been conducting a pre-arrest inquiry (a process for examining the facts before a case is formally booked) since October 2. They subsequently formally booked the case on suspicion of violating the Information and Communications Network Act. This means the case has officially moved into the investigation phase; it does not mean that a crime has been established or that a suspect’s responsibility has been determined.

Whether the case must be reported to the Serious Crimes Investigation Agency is not determined solely by whether the victimized institution is a financial company. According to reports, cybercrimes subject to notification include violations of the Information and Communications Network Act stemming from hacks of National Core Infrastructure (국가핵심기반), and violations of the Electronic Financial Transactions Act (전자금융거래법) stemming from hacks of electronic financial infrastructure. Police believe that even if the victimized financial institution itself is not National Core Infrastructure, the case could be subject to notification if the breached system is electronic financial infrastructure.

The authoritative interpretation requested from the Financial Services Commission (금융위원회)—an official interpretation issued by a relevant agency on how a law or system applies—is therefore an important turning point. Whether the case must be reported depends on determining what type of facility the system is. However, what has been confirmed so far is only that police asked the Financial Services Commission for an interpretation. This does not mean that the interpretation has been issued or that notification to the Serious Crimes Investigation Agency has been decided.

What this means

The investigation is focused not only on establishing the facts of the hacking but also on determining the legal category of the system that was breached. The issue has drawn attention because the system’s classification could affect the legal route that may apply and how the relevant agencies respond. However, based on the reported information alone, it is not possible to know whether the Serious Crimes Investigation Agency will actually take charge of the investigation or how investigative procedures would proceed after notification.

For customers of financial companies, it may be important to check whether they were affected and to what extent. Other reports have mentioned information leaks at several financial companies and the possibility of customer impact, but it has not been confirmed whether the scope described in those reports matches the case police have formally taken up. For example, customers of a financial company involved in this case may find it useful to check whether the company issues separate notices about possible harm or protective measures. This does not mean that harm has been confirmed; it reflects the fact that current reports do not clearly distinguish the scope of each case.

The size of the investigative team alone cannot predict the outcome of the investigation or recovery of losses. Police have said they will work with relevant agencies to conduct a swift and thorough investigation. In practice, confirmation of the breached system, the Financial Services Commission’s interpretation, and the facts established during the investigation could all affect subsequent decisions.

Related rules and support information

Internal legal guide L1 explains that, when determining whether there was unauthorized access under the Information and Communications Network Act, knowing a username and password or having been authorized to use them in the past does not, by itself, establish that access is currently authorized. The specific circumstances—including the permissions granted by the service provider and whether those permissions remain valid—must be considered. This does not mean that the breached system or method of access in this case has been confirmed, nor does it replace the police assessment of the alleged offense.

Accordingly, rather than drawing conclusions about the applicable law or liability solely from the fact that someone accessed a financial company’s system, it is necessary to establish what system was accessed, with what authorization, and whether the system qualifies as electronic financial infrastructure. L1 also cautions that legal conclusions require checking the specific facts and the laws currently in force. This material does not identify a separate support program or application deadline for victims of the financial institution hack.

Differences in reporting

Reports on the launch of the police investigation said that the case had been formally booked, that a dedicated 28-member team had been formed, that notification to the Serious Crimes Investigation Agency was under consideration, and that police had requested an authoritative interpretation from the Financial Services Commission. Meanwhile, another report said that information leaks had been reported at seven financial companies and that more than 67,000 people may have been affected. A separate report said that some of the IP addresses used in the Shinhan Bank hack had also attempted to access Toss Bank servers, but were blocked.

These reports cover hacking incidents and access attempts reported across the financial sector, but the evidence presented does not establish how much the affected institutions, number of people, or access attempts in each report overlap with the case formally taken up by police. The figures in other reports should therefore not be read as a confirmed measure of the damage in this police investigation.

What is known and what remains unclear

Confirmed facts

  • Police conducted a preliminary inquiry before formal booking beginning October 2, then formally booked the case on October 6 on suspicion of violating the Information and Communications Network Act and moved it into the full investigation phase.
  • The National Police Agency’s Cyber Terrorism Investigation Unit was designated as the dedicated investigative team, consisting of four teams and 28 members in total.
  • Police requested an authoritative interpretation from the Financial Services Commission on whether the breached system is electronic financial infrastructure.
  • Whether the case must be reported to the Serious Crimes Investigation Agency is under review; it has not been confirmed that notification has been decided.

What remains unclear

  • The specific circumstances of the hack and the identity of the breached system.
  • The extent to which the financial companies and damage figures mentioned in other reports overlap with the scope of the police investigation.
  • Who carried out the attack and how the Financial Services Commission will determine whether the system qualifies as electronic financial infrastructure.
  • Whether the case will be reported to the Serious Crimes Investigation Agency and how subsequent investigative procedures will be determined.

What readers can check

  • Check the relevant financial company’s notices for information on whether you were affected and what guidance it provides. Do not assume that the figures in other reports cover the same scope as the police case.
  • If you receive a message claiming that there has been hacking or a personal information leak, verify it through the financial company’s official notices. This guidance does not mean that secondary harm is currently occurring; it is a precautionary check in light of the need to clarify the scope of the incident.
  • Follow the Financial Services Commission’s interpretation of the system’s classification separately from any police decision on notification to the Serious Crimes Investigation Agency. A request for an authoritative interpretation and consideration of notification do not mean that either decision has been made.

References