Hackers targeting major financial firms first tried hitting internet-only banks
The same IP addresses linked to recent bank data leaks in Korea were also found to be behind earlier attacks on KakaoBank, Kbank and Toss Bank, though all attempts were blocked.
The logos of Korea's three major internet-only banks are seen in the photo. From top to bottom: Toss Bank, Kakao Bank and Kbank
YONHAP
Cyberattack attempts on major banks last week have raised concerns that the hackers may have targeted Korea's financial sector far more broadly — and far earlier — than first believed.
Several capital financing companies and banks, including Hana Bank, KB Kookmin Bank and Shinhan Bank, suffered back-to-back leaks of customer information in attacks last week by hackers who remain at large.
After the attempts, Korea's financial authorities then shared the IP addresses used in the attacks with other financial institutions and told them to run their own security checks. Based on the results, it was found that some of the addresses had also been used earlier this year in attempts to access servers at internet-only lenders KakaoBank and Kbank, according to financial industry sources on Tuesday.
At KakaoBank, hackers using the IP addresses made several attempts to access its servers beginning in January. KakaoBank’s security system, however, detected and blocked the attempts. No subsequent attacks or actual breaches have been identified so far.
Kbank also detected access attempts from the same IP addresses, but likewise, no damage occurred.
Hackers using the IP addresses also reportedly attempted to access Toss Bank servers about 10 times between January and August. Toss Bank also blocked the attempts before they could penetrate its systems, and no security breaches, including leaks of customer data, occurred.
Financial industry officials are examining the possibility that the activity was not a one-off attack targeting specific financial companies, but part of a broader effort to probe multiple financial institutions for vulnerabilities.
“Attackers typically attempt to access a large number of institutions to determine whether they have vulnerabilities, then launch further attacks if they find a weakness or their initial attempts are not blocked,” a financial industry source said.
BY JEONG JAE-HONG [[email protected]]
This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
