More than half of the ransomware crimes reported in South Korea over the past five years and eight months have had their investigations suspended, as hacking attacks on financial firms and companies mount. Police say attacks are growing more sophisticated and increasingly rely on overseas servers, making it harder to trace suspects. Ransomware cases this year have already exceeded last year's annual total, yet not a single suspect has been arrested.
A total of 329 ransomware crimes were reported between 2021 and August this year, according to data submitted by the National Police Agency to Rep. Yang Boo-nam of the Democratic Party of Korea, a member of the National Assembly's Public Administration and Security Committee, on the 25th. Police decided to suspend investigations in 183 of those cases, or 55.6% of the total.
Suspended investigations numbered 33 in 2021, 52 in 2022, 39 in 2023, 22 in 2024, 18 last year and 19 in the first eight months of this year. Arrests over the same period totaled just 19 — 12, three, two, zero, two and zero by year. Through August this year, 33 ransomware crimes were reported, already surpassing last year's annual total of 32, with no arrests made.
A suspended investigation is a procedure that temporarily halts a case when the whereabouts of a suspect cannot be determined or necessary evidence cannot be secured within a short period. The case is not closed, but handling can be delayed for a long time until a suspect is traced or evidence is obtained.
Officials point to increasingly advanced attack methods and criminal organizations based overseas as the reasons ransomware investigations are difficult. Ransomware is malicious software that encrypts data stored on a victim's computer or server and demands money in exchange for restoring access. Because the groups behind the attacks often use overseas servers or conceal their identities, international cooperation is effectively essential to identify suspects and secure evidence. Cooperation with foreign law enforcement agencies takes considerable time, however, leading to prolonged or suspended investigations.
Damage from cyberattacks is spreading to financial firms, companies, state-run institutions and universities. As of the 14th of this month, 16 financial companies had confirmed hacking breaches, with leaked information including personal data approaching 100,000 records, according to financial authorities.
While the importance of responding to cybercrime is growing, the overhaul of the criminal justice system has also created confusion over the division of roles among investigative agencies. Police recently judged a hacking case involving a financial institution to be a serious crime and notified the Serious Crime Investigation Agency, which was launched early this month. The agency decided not to open an investigation, however, citing factors including that police had already carried out a substantial part of the inquiry and that the case required international cooperation. As a result, police will continue to handle the case.
"Even after notifying the Serious Crime Investigation Agency, we have continued investigating without any gap," police said. "We will investigate thoroughly with a sense of responsibility, as before, and track down the suspects."