Financial Authority Interprets Hacking-Affected Systems as Electronic Financial Infrastructure

Police investigating a series of hacking incidents in the financial sector plan to add charges of violating the Electronic Financial Transactions Act and notify the Serious Crimes Investigation Agency (SCIA). This decision follows an interpretation from the Financial Services Commission (FSC) suggesting that the systems of the affected financial institutions could be classified as electronic financial infrastructure under the law.

According to financial authorities on October 20, the FSC recently responded to a request from the National Police Agency's National Investigation Headquarters, indicating that the systems of the hacked financial institutions might fall under the definition of electronic financial infrastructure as per the Electronic Financial Transactions Act. An FSC official stated, "This was a response to the police's inquiry regarding the matter."

Previously, the police had sought clarification from the FSC to determine whether the hacking incidents in the financial sector warranted notification to the SCIA. According to the SCIA Act, other investigative agencies must immediately inform the SCIA director if they recognize serious crimes during their investigations. Violations of the Electronic Financial Transactions Act due to hacking of electronic financial infrastructure are also included in this notification requirement.

The key issue was whether the internal operational systems of the financial institutions targeted by the hacking attacks could be considered facilities used for electronic financial transactions. While the police determined that the affected systems did not qualify as national critical infrastructure, they believed that the FSC's interpretation was necessary to ascertain whether they fell under electronic financial infrastructure.

The National Investigation Headquarters announced that it would add charges of violating the Electronic Financial Transactions Act in addition to existing charges under the Information and Communications Network Act and notify the SCIA. This decision was made after considering the investigation details, legal reviews, the FSC's interpretation, and the opinions of the affected financial institutions.