Police expand financial hacking probe team to 43, add forensic specialists

Police expanded the team investigating hacking attacks on financial institutions to 43 members in South Korea on Friday, adding digital forensics and international cooperation specialists. Data leaks have been confirmed at seven financial firms, and police formally opened the investigation on Tuesday. The case could later be transferred to the Serious Crimes Investigation Agency, but police said they will continue pursuing suspects until any transfer occurs.

The National Office of Investigation increased the investigative team from 28 to 43 members.

Police said they are securing data, analyzing affected systems and working internationally, including to block servers used in the attacks.

The Serious Crimes Investigation Agency launched Oct. 2 and may demand the transfer of major-crime cases, including cybercrime investigations.

Police said they began a preliminary inquiry on Oct. 1, the day the hacking was first reported in the media, and secured log records soon afterward.

Published Oct 9, 2026 3:39 pm KST

Police have expanded the team investigating a recent series of hacking attacks on financial institutions to 43 members from the previous 28, adding specialists in digital forensics and international cooperation.

The National Office of Investigation, the investigative arm of the Korean National Police Agency, announced the reinforcement Friday.

“We are investigating thoroughly, securing relevant data and analyzing the affected systems,” police said, adding that they are also pursuing international cooperation, including blocking the servers used in the attacks.

Data leaks have been confirmed at seven financial firms, including major commercial banks, and police opened a formal investigation on Tuesday.

The announcement came amid questions over whether the case will be handed to the Serious Crimes Investigation Agency (SCIA), which launched Oct. 2 and took over the investigation of major crimes, including cybercrime, from the now-abolished prosecutors’ office.

Under the law governing the SCIA, police and other investigative bodies must notify the agency immediately when they judge a case to be a major crime, even if they detected it first. The SCIA chief may also demand a transfer regardless of how far another agency’s investigation has progressed.

“Even if the case is later transferred to the SCIA, we will thoroughly track down the suspects until then so that there is no gap in the investigation,” police said.

They said confusion over jurisdiction or delays cannot occur because police investigate until a transfer and the SCIA afterward.

Police also rejected criticism that their initial response was slow. They said they began a preliminary inquiry — a fact-finding step before a formal criminal investigation — on Oct. 1, the day the hacking was first reported in the media.

They said they quickly secured log records and set up cooperation with bodies including the Financial Security Institute, which handles cybersecurity for the financial sector.

韩国警方周五将调查金融机构遭黑客攻击事件的团队扩充至43人，新增了数字取证和国际合作专家。目前已确认七家金融机构发生数据泄露事件，警方于周二正式展开调查。此案之后可能会移交至重案搜查厅，但警方表示，在案件移交之前，他们将继续追查嫌疑人。

国家调查局将调查小组的成员从 28 人增加到 43 人。

警方表示，他们正在保护数据、分析受影响的系统并开展国际合作，包括封锁攻击中使用的服务器。

重大犯罪调查机构于10月2日成立，可能会要求移交重大犯罪案件，包括网络犯罪调查。

警方表示，他们在10月1日，也就是媒体首次报道黑客攻击事件的当天，就开始了初步调查，并在不久后获得了日志记录。

发布于2026年10月9日下午3:39（韩国标准时间）

警方已将调查近期一系列针对金融机构的黑客攻击的团队从之前的 28 人扩大到 43 人，增加了数字取证和国际合作方面的专家。

韩国国家警察厅下属的调查机构——国家调查室周五宣布了这一增援计划。

警方表示：“我们正在进行彻底调查，确保相关数据安全，并分析受影响的系统。”他们还补充说，他们也在寻求国际合作，包括封锁攻击中使用的服务器。

七家金融公司（包括多家大型商业银行）已证实发生数据泄露事件，警方于周二展开正式调查。

此前有疑问称，该案件将移交给重案调查局（SCIA）。重案调查局于 10 月 2 日成立，接管了此前已被撤销的检察机关对包括网络犯罪在内的重大犯罪的调查。

根据有关重大犯罪调查局（SCIA）的法律规定，警方和其他调查机构一旦认定案件属于重大犯罪，即使他们率先发现了案件，也必须立即通知该机构。SCIA局长还可以要求将案件移交其他机构，无论其他机构的调查进展到何种程度。

警方表示：“即使案件之后移交至刑事调查局，我们也会在此之前彻底追踪嫌疑人，以确保调查不出现任何漏洞。”

他们表示，由于警方会在移交案件之前进行调查，之后再由 SCIA 进行调查，因此不会出现管辖权混乱或延误的情况。

警方还驳斥了外界对其最初反应迟缓的批评。他们表示，早在10月1日，也就是媒体首次报道黑客事件的当天，他们就启动了初步调查——这是正式刑事调查前的事实调查步骤。

他们表示，他们迅速获取了日志记录，并与包括金融安全研究所（负责金融行业的网络安全）在内的机构建立了合作关系。