KR — ZDNet Korea

FSI Says Financial Sector Hacks Cannot Be Pinned on North Korea Based on IP Alone

SecurityOctober 29, 20261 min read

South Korea's Financial Security Institute (FSI) says it is hard to blame North Korea for recent attacks on banks and financial firms just because North Korean IP addresses were seen. The FSI responded to news reports that linked the attacks to North Korea.

What happened

A news outlet reported that hacking attacks on the financial sector were the first to be confirmed as coming from North Korean IP addresses. On the 29th, the FSI released an explanation. It said it had warned financial firms on the 21st after it detected many visits from North Korean IP addresses. This warning is a normal step taken when many suspicious traffic attacks are seen. It was not aimed at any one country.

Key facts

The FSI issued its warning on the 21st after detecting a large number of access attempts from North Korean IP addresses.
The FSI explained that an attacker's IP address can be faked or changed on purpose.
No hacking incident linked to these North Korean IP addresses has been confirmed so far.

Why an IP address is not enough

An IP address is like a return address on a letter. It shows where a message seems to come from, but anyone can fake it. Attackers can also use a server in another country as a stepping stone to hide where they really are. So seeing a North Korean address does not prove North Korea did the attack.

Why it matters

Blaming a country for a cyberattack is a serious claim. If the wrong country is blamed, it can cause diplomatic problems and hide the real attacker. The FSI's message is that experts need more proof before naming any country. The FSI also said it shares threat information with financial firms in real time and blocks suspicious traffic quickly.

What to watch

Whether investigators find proof linking the attacks to North Korea or to a third party.
Whether any hacking incident is confirmed that is tied to the North Korean IP addresses.
How financial firms respond to the FSI's real-time threat sharing system.

Glossary

IP: Internet Protocol address, a number that identifies a device on the internet.

Massive leak exposes 41,000 DHS workers and undercover ICE agents

A leak of Department of Homeland Security records has exposed details of more than 41,000 DHS employees and contractors, including email addresses, phone numbers, office addresses, references to internal systems, and information on undercover and surveillance programs. The records cover DHS and seven component agencies, including ICE and CBP, and were last updated on August 19, 2026. The transparency nonprofit Distributed Denial of Secrets published the archive, which it obtained from a group calling itself the Department of Peace; DDoSecrets says the data came from DHS's Okta login system, while Okta says it is unaware of any breach of its systems.

SecurityZDNet KoreaOct 29

"Accelerating Autonomous SOC"... Igloo Expands AI Agent "AiR" to Three Products

Igloo Corporation, an AI-based security operations and analytics platform company, is expanding its cybersecurity AI agent brand "AiR (AI Road)" into a three-product lineup: AiR mate, AiR works, and AiR clue. The company plans to launch the AI agent orchestration platform AiR works in the first quarter of next year to support Agentic SOC implementations tailored to each organization and accelerate the realization of the Autonomous SOC. AiR mate and AiR clue are currently available as services.

SecurityITmediaOct 29

Personal Data Leaks from Unauthorized Access Reach 260 Million Cumulative Individuals in Just Over Half a Year, More Than Twice Japan's Population

Japan's Personal Information Protection Commission reported that cases of personal data leaks or suspected leaks caused by unauthorized access, reported between April 1 and October 16, 2026, affected a cumulative total of about 260 million people, more than twice Japan's total population as of October 1, 2026. The number of reported cases reached 2,094, with October alone accounting for roughly 40% of the total and daily reports rising sharply. The figures include duplicates, cover only incidents reported directly by private businesses, and are preliminary and subject to change.

SecurityVnExpressOct 29

Over 40,000 U.S. Security Agency Employee Records Leaked

Hackers breached the U.S. Department of Homeland Security (DHS) and stole personal data of more than 40,000 employees, according to the nonprofit leak-focused group Distributed Denial of Secrets, which said it obtained the data from a group calling itself "Department of Peace." The dataset includes names, titles, phone numbers, emails and office addresses of staff at agencies such as ICE, CBP, HSI and CISA, and TechCrunch verified parts of it by matching names of security personnel. DHS said it is aware of the security risk, is actively responding, and will publicly update as more information becomes available.