Four in five data breach cases go unsolved as cyberattacks surge

Cyberattacks targeting personal and public-institution data have risen for three consecutive years and already surpassed 2,800 cases in the first half of this year alone — yet arrest rates remain stuck in the low 20 percent range.

Data submitted by the Korean National Police Agency to People Power Party lawmaker Ko Dong-jin's office on Wednesday show that cyber intrusion cases involving the theft or attempted theft of personal or public-institution data climbed from 3,494 in 2022 to 4,223 in 2023, 4,526 in 2024 and 4,765 last year — a 36 percent increase over three years.

This year, 2,844 cases had already been recorded through June, a pace that projects to roughly 5,700 for the full year and would far exceed last year's total. Hacking accounted for the largest share of first-half incidents at 2,303 cases, followed by malware at 151 cases and distributed denial-of-service attacks at 12 cases.

Arrests have consistently lagged far behind incident counts. The arrest rate stood at 20 percent (729 cases) in 2022, 28 percent (1,184 cases) in 2023, 21 percent (985 cases) in 2024 and 26 percent (1,265 cases) last year. So far this year, only 544 arrests have been made out of 2,844 cases through June, pushing the arrest rate down to 19 percent — roughly one arrest for every five incidents.

Police say investigative staffing has failed to keep pace with the rapid growth in cybercrime. "Most crimes are now conducted online, making it increasingly difficult to treat 'cybercrime' as a separate category," a police official said. "As incidents multiply faster than arrests can follow, we need to expand investigative personnel and related infrastructure to match the reality on the ground."

The cross-border nature of cyberattacks adds another layer of difficulty. Attacks originating abroad cannot be fully traced through domestic investigations alone, requiring coordination with foreign law enforcement — and such requests are on the rise.

International cooperation requests filed by Korean police with overseas agencies, including those in China, over cyber intrusion cases grew consistently — from 154 in 2022 to 112 in 2023, 224 in 2024 and 260 last year. Through July this year, police had already filed 254 requests, surpassing last year's full-year total.

Foreign connections have also surfaced in several high-profile data breach investigations. In the probe into the SK Telecom SIM card data leak, police discovered overseas IP addresses and have launched an international cooperative investigation to identify the perpetrators.

"Attacks from abroad are difficult to attribute to a specific actor, which limits our ability to make arrests," a cyber investigation official said. "Even in domestic cases, tracking is not easy when IP addresses cannot be identified."