Seoul serious crimes agency declines to take over AI hacking probe of financial institutions

The Serious Crimes Investigation Agency has decided not to open its own investigation into a hacking case targeting financial institutions' AI systems, after receiving a notification from police. The agency determined that police, having already made substantial progress in the case, should continue leading the probe.

The Seoul Serious Crimes Investigation Agency said Friday it had notified police — who had informed the agency of the AI hacking case on Wednesday — that it would not be opening an investigation.

"We reviewed the details of the case and the progress of the investigation," the agency said. "As a result, we determined that it is appropriate for police to continue the investigation, given that police had already launched the probe before the agency's opening date, that the investigation is well underway, and that international cooperation with overseas agencies is ongoing."

The agency added that it would "actively cooperate with police and respond strictly to cyberterrorism crimes, including the financial institution hacking case."

The case involves the leak of customers' personal information from major domestic banks and other financial institutions following intrusions by hacking groups. Analysts have suggested the incidents share similar methods and are believed to involve AI-based cyberattacks.

Police launched a preliminary investigation on Oct. 1 and formed a dedicated investigative team five days later to begin a full-scale probe. On Tuesday, police said they had additionally recognized a violation of the Electronic Financial Transactions Act, on top of an existing Information and Communications Network Act violation, and notified the agency of the case.

Under the Serious Crimes Investigation Agency Act and its enforcement decree, police must immediately notify the agency upon recognizing a serious crime, and if they first give notice by phone or other means, they must follow up in writing within three days of the date of recognition. The agency is in principle required to respond within seven days of receiving the written notification on whether it will open an investigation, though the response period may be extended if unavoidable circumstances arise.