Korean police enlarge financial-hacking task force by more than half to 43 investigators
South Korea's police added 15 specialists to the team investigating hacks of financial institutions, taking it from 28 to 43 investigators. Because the trail leads to attack servers abroad and the case could be handed to another agency, part of the probe's timing depends on people outside the police.
The Investor · Invest desk
Police added 15 specialists, enlarging the team from 28 members to 43. Affected financial firms handed over data and systems used to analyze intrusion routes. Under current law, the Major Crimes Investigation Agency's head may request a transfer at any stage.
- Who has to decide decision Korean National Police Added 15 specialists, enlarging the dedicated investigation team from 28 members to 43, claim 1
- Who's exposed exposure Affected financial firms Handed over data and systems; investigators are analyzing intrusion routes from them, claim 5
- What's now possible capability Major Crimes agency Under current law, its head may request a transfer of a qualifying case regardless of how far it has progressed, claim 10
| Who | How | Kind | Claim |
|---|---|---|---|
| Korean National Police | Added 15 specialists, enlarging the dedicated investigation team from 28 members to 43 | decision | 1 |
| Affected financial firms | Handed over data and systems; investigators are analyzing intrusion routes from them | exposure | 5 |
| Major Crimes agency | Under current law, its head may request a transfer of a qualifying case regardless of how far it has progressed | capability | 10 |
What happened
- Police say they opened a pre-charge inquiry on Oct. 1, the day the hacking was first reported, and reject suggestions that their first response was slow.
- Yonhap named Hana Bank, KB Kookmin Bank and Shinhan Bank among the financial companies hit by the attacks.
- Investigators are tracing intrusion routes from data and systems handed over by the affected institutions and are seeking foreign help to block attack servers based overseas.
- Under current law, the head of the Major Crimes Investigation Agency can ask for a qualifying cyber case at any stage of an investigation.
Why it matters
- What it limits constraint A firm dealing with police investigators now may finish the case dealing with a different agency, because the Major Crimes Investigation Agency's right to ask for it does not expire as the police work advances.
- Who's exposed exposure The attacked institutions have handed over their data and systems, so the timing of their own incident reviews now depends on a police trace that relies partly on help from abroad.
- Who has to decide decision Police chose to keep the case and add staff to it while a referral is debated, so any transfer would move a case already well into forensic analysis.
Next story · Leadership · Oct 8
CrowdStrike traces AI-assisted attacks on South Korean banks to one possible suspect in GuangdongConfirmed6 publishers
Eight days passed between the first report of the intrusions and a 43-person team [12]. The task force was formed on Oct. 5 and the forensics specialists were assigned on Oct. 7 [4]. On Tuesday, Oct. 6, between those two dates, President Lee Jae Myung told the government to put more personnel and resources into limiting the damage, Yonhap reported [7][13]. The 15 additions enlarge the team by about 54% and make up about 35% of it [14][15].
The new hires are there to establish who did it. Police said the forensics and international-cooperation specialists are meant to speed up tracing how the intrusions happened and who was behind them [8]. A police official described the current work as "securing necessary materials such as log records and analyzing the compromised systems" [6]. Neither report includes a loss figure, a count of the institutions hit or the identity of a suspect.
Police do not set the timetable for two parts of this case. Getting an attack server abroad blocked needs someone in another jurisdiction to act, and police list that work under international cooperation [5]. The second is the transfer right [10]. Attention has settled on whether the Major Crimes Investigation Agency will take the case, and some worry that a change of investigator would leave gaps or delays [11]. Police say they will run the case until any transfer and the agency will run it afterward, so there will be no confusion over who is in charge and no "case ping-pong" [17]. "Even if the case is later transferred to the Major Crimes Investigation Agency, we will thoroughly track the suspects so that there is no investigative gap until then," the police agency said [16].
The case can go one of three ways. In the first, police trace the intrusions, get the overseas servers blocked and keep the file until charges are brought. In the second, the agency asks for the case partway through, and the promise of no gap gets tested at the handover. In the third, the trail ends at foreign servers that stay online, and the attribution work stalls whichever body holds it.
I think firms with exposure to the banks Yonhap named should plan around the second or third outcome, because each adds time that police cannot schedule [2]. The counter-case is the first week. Police went from a pre-charge inquiry to 43 investigators in eight days with a presidential instruction behind them [12][7]. A team built that fast could finish the trace before anyone asks for a transfer.
The view is wrong if police name who was behind the intrusions while the case is still theirs.
What to watch
- Whether the head of the Major Crimes Investigation Agency requests a transfer, and how far the police work has got when it happens.
- Any police confirmation that attack servers abroad have been blocked, and in which jurisdictions.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+10
- Incentives60
- Confidence64
Perspective Coverage
3 publishers- Builder
- Builder 25%
- Operator
- Operator 52%
- Investor
- Investor 23%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The National Office of Investigation at the Korean National Police Agency said on Oct. 9 it had added 15 specialists to the dedicated investigation team, enlarging it from 28 members to 43.
- [2]
The National Office of Investigation said it added 15 more personnel to the 28-member team probing attacks against multiple financial companies, including Hana Bank, KB Kookmin Bank and Shinhan Bank.
- [3]
South Korean police announced the team expansion on Friday, Oct. 9.
- [4]
Police formed the task force on Oct. 5 and assigned additional specialists, including digital forensics experts, on Oct. 7.
- [5]
Investigators are analyzing intrusion routes and other details based on data and systems obtained from the affected financial institutions, and are pursuing international cooperation, including blocking attack servers based overseas.
- [6]
"We are conducting a thorough investigation, securing necessary materials such as log records and analyzing the compromised systems."
- [7]
President Lee Jae Myung on Tuesday instructed the government to dedicate more personnel and resources to prevent and minimize damage from the recent series of hacking attacks.
- [8]
By adding specialists in digital forensics and international cooperation, police aim to accelerate efforts to trace how the intrusions occurred and who was behind them.
- [9]
Police rejected suggestions that their initial response was slow, saying they launched a pre-charge inquiry immediately on Oct. 1, when the hacking of financial institutions was first reported.
- [10]
Under current law the Major Crimes Investigation Agency may investigate cyber crimes that qualify as major crimes; another body that learns of such a case first must notify the agency, and the agency's head may request a transfer regardless of how far the investigation has progressed.
- [11]
Attention has focused on whether the case will be referred to the Major Crimes Investigation Agency, with concerns raised that a change in the investigating body could create gaps or delays.
- [12]
Eight days separate the first report of the hacking on Oct. 1 from the Oct. 9 announcement of a 43-person team.
- [13]
The president's Tuesday instruction fell on Oct. 6, between the task force's formation on Oct. 5 and the assignment of specialists on Oct. 7.
- [14]
The 15 additions enlarge the team by about 54%.
- [15]
The newly added specialists make up about 35% of the 43-person team.
- [16]
"Even if the case is later transferred to the Major Crimes Investigation Agency, we will thoroughly track the suspects so that there is no investigative gap until then."
- [17]
Police said that because they will handle the investigation until any transfer and the agency will take over afterward, there will be no confusion over who is in charge and no delays or gaps from so-called case ping-pong.
Sources
2 independent publishers whose own reporting we read for this story.
- en.sedaily.comPolice Expand Financial Hacking Task Force to 43 Investigators
1 article · October 8, 2026
- en.yna.co.krPolice expand team investigating recent hacking of financial institutions
2 articles · October 9, 2026
- koreajoongangdaily.comPolice add personnel to team investigating cyberattacks against financial institutions
1 article · October 9, 2026
Topics and entities
Topics
- South Korean law enforcement
- Cybercrime investigation
- Financial Sector Cybersecurity