0
The National Police Agency. / Yonhap News

Police converted the recent financial institution hacking incident into a formal investigation and established a 28-member dedicated investigation team. Whether the case must be notified to the Major Crimes Investigation Agency is expected to hinge on whether the compromised system qualifies as an electronic financial infrastructure.

The National Investigation Headquarters of the National Police Agency announced on the 6th that after confirming objective facts regarding the financial institution hacking incident, it booked the case under suspicion of violating the Information and Communications Network Act and launched a formal investigation.

Considering the gravity of the case, police designated the Cyber Terror Investigation Unit of the National Police Agency as the dedicated investigation team. Led by the head of the Cyber Terror Response Division, four teams comprising a total of 28 personnel will be deployed to the probe.

While investigating the hacking circumstances and scope of damage, police are also examining whether the case falls under matters that must be notified to the Major Crimes Investigation Agency.

The Major Crimes Investigation Agency Act stipulates that when other investigative agencies detect major crimes during an investigation, they must immediately notify the head of the Major Crimes Investigation Agency. Police explained that cybercrimes, including hacking, can become subject to notification under largely two criteria.

First, hacking targeting critical national infrastructure constitutes an offense subject to notification if it violates the Information and Communications Network Act. Critical national infrastructure refers to facilities and information technology systems in fields such as energy, information and communications, transportation, and health care that can exert significant impact on the national economy, public safety, and core government functions.

As of June 2026, there are 374 designated critical national infrastructure sites in total. Among them, nine facilities across eight institutions are designated in the financial sector: the Bank of Korea Gyeonggi IT Center, the Korea Development Bank, the Industrial Bank of Korea, the Export-Import Bank of Korea headquarters and Yongin IT Center, the Korea Financial Telecommunications and Clearings Institute, the Korea Exchange, Koscom, and the Korea Securities Depository.

Police determined that the victim financial institution in this case is not classified as critical national infrastructure, meaning it does not qualify for notification under this criterion.

However, the situation could change if the victimized system constitutes an electronic financial infrastructure under the Electronic Financial Transactions Act. The Electronic Financial Transactions Act defines information processing systems and information and communications networks used for electronic financial transactions as electronic financial infrastructure. Accessing such facilities without authorization, or manipulating, destroying, concealing, or leaking stored data, carries penalties of up to 10 years in prison or a fine of up to 100 million won.

Crimes defined under the Electronic Financial Transactions Act are included in the category of major crimes under the Major Crimes Investigation Agency Act. Accordingly, police have requested an authoritative interpretation from the Financial Services Commission on whether the system breached in this hacking incident constitutes an electronic financial infrastructure. If the commission determines the system to be an electronic financial infrastructure, the case could become subject to notification to the Major Crimes Investigation Agency.

A police official stated, "We will conduct a prompt and rigorous investigation in close cooperation with relevant agencies to alleviate public concern."

                                                                                                           Seol So-young