Korean police need a financial regulator's ruling to decide who investigates the Shinhan Bank hack

"If the affected system qualifies as electronic financial infrastructure under the Electronic Financial Transactions Act, the case must be reported to the SCIA," a police official said, according to the Korea JoongAng Daily ^[5]. "We have asked the Financial Services Commission for an official interpretation of whether the system qualifies," the official said ^[6]. The charge already filed comes under a different law, the network act ^[2]. So which agency runs a criminal case now depends on a financial regulator reading a financial statute ^[6]. The Serious Crimes Investigation Agency launched on Friday with cybercrime in its remit ^[4], four days before the case was booked ^[13]. The Sept. 28 attack came about three days before the agency existed ^[15].

If the commission says the system qualifies, referral is mandatory on the official's account ^[5]. If it says no, the file stays with the National Office of Investigation ^[3] and its four teams of seven ^[14]. A third outcome holds either way. Investigators are working with foreign authorities to track the addresses located overseas ^[8], and that work is the same whichever Korean agency holds the file.

I think the commission's answer matters more for the next attack than for this one. The referral test is written into statute ^[5]. A yes would send AI-driven attacks on any bank system that meets the same definition to the SCIA. A no would keep them with the police as network-act cases ^[2]. The counter-case is that attribution decides whether anyone is ever charged, and attribution runs through foreign cooperation regardless ^[8]. The view is wrong if the commission's interpretation turns on features of this one system, leaving the next bank's system to be classified from scratch.

The report does not identify the attacker or say what, if anything, was taken from Shinhan Bank ^[1]. With the Artex AI traces discounted ^[9], identification rests on the address trace ^[8]. The 28 investigators assigned ^[2] compare with a national flow of about seven breach reports a day. The Korea Internet & Security Agency received 1,236 reports in the first half of this year, up 19.5 percent ^[12], from roughly 1,034 a year earlier ^[16].

IBM's Cost of a Data Breach Report 2026 found AI involved in one in four malicious breaches at 602 organizations between March 2025 and February 2026, a share up 56 percent on the previous year ^[11]. That puts the prior year at roughly 16 percent ^[17]. "Hackers attack every security vulnerability they can find, and AI makes them dramatically faster," said Kwak Jin, a professor of cybersecurity at Ajou University ^[10]. "A breach at even one point means data gets out, so the burden on defenders can only grow." ^[10]