Chinese financial hackers claim 'number theft'... Police: "Keep the possibility open"

A Chinese man who was identified as an attacker who hacked domestic financial institutions reportedly stated that he was not involved in the hacking, saying that his mobile phone number was stolen.

In relation to this, the police maintain that they are keeping all possibilities open and are continuing their investigation to secure evidence.

On the 8th, a police official explained to Yonhap News regarding the 'denial report' of a Chinese person who was pointed out as a hacking attacker, "We are investigating with all possibilities open," and "The police investigation is based on evidence, and the investigation is in progress to secure evidence."

He added that he could not confirm the specific investigation method.

Previously, global cybersecurity company CrowdStrike stated in an analysis report on the 7th (local time) that the Korean financial sector attacker was likely a 26-year-old person living in Guangdong Province, China.

The personal information released by the company included the English initials 'YY', residence in Maoming City, Guangdong Province, and education at Huanan Institute of Technology, as well as phone number and Telegram account.

This information was found in artificial intelligence (AI) conversation records left by the attacker on a Hong Kong-based server.

The attacker requested the AI ​​coding tool 'Claude Code' to write a security researcher's resume and entered information such as name, age, place of residence, education, phone number, and Telegram account.

The company said that although the Telegram account in question has been discovered in other cyberattacks, the identity of the attacker cannot be determined based on the information obtained so far.

Some Korean media reported that they had contacted this man and claimed that he had nothing to do with the hacking incident, saying, "(The hacker) appears to have stolen his cell phone number."

He countered by saying that the only basis for pointing out him as an attacker was his cell phone number, and also said that he was preparing to change his number due to the influx of calls.

This financial sector hacking incident emerged from the end of last month to the beginning of this month when a series of breaches were confirmed at seven financial companies, including Shinhan, KB Kookmin, Hana, BNK Busan Bank, Yegaram, Welcome Savings Bank, and Hyundai Capital.

The National Police Agency's Cyber ​​Investigation Bureau is analyzing related data and tracking the attacker.