'Ransomware' Disrupts SGI Seoul Guarantee Insurance Systems for Extended Period... "Immediate Recovery Difficult"

Due to the aftermath of a ransomware attack, SGI Seoul Guarantee Insurance has been experiencing system failures for a second consecutive day, causing disruptions in bank loan services such as mortgage loans and jeonse loans.

According to the financial sector on July 15, a system failure caused by a ransomware attack has been affecting Seoul Guarantee Insurance since the morning of the previous day and continues as of now. Seoul Guarantee Insurance is currently working on recovery efforts together with IT risk-related officials from the Financial Supervisory Service and the Financial Security Institute.

Seoul Guarantee Insurance provides essential financial services required in everyday life, including mobile phone installment activations, real estate jeonse guarantee services, and loan guarantees for financial institutions. In the case of bank jeonse loans, the structure requires passing Seoul Guarantee Insurance’s eligibility screening, after which loans are issued within the guarantee limit. As a result, disruptions are also occurring in bank loan operations.

As the recovery process has been prolonged, Seoul Guarantee Insurance has been working with major commercial banks since the previous day to allow tenants eligible for jeonse loan guarantees to receive loans first and obtain the guarantee afterward (“loan first, guarantee later” policy). For guarantee insurance required for mobile phone installment activations, the company is taking similar measures in consultation with mobile carriers. For time-sensitive performance guarantee insurances, such as bid bonds for participation in construction, goods purchase, or service tenders, and deposit guarantee insurance that replaces cash deposits with insurance certificates, these are being issued manually at branch offices. A representative from Seoul Guarantee Insurance stated, “We are making every effort to minimize inconvenience to our customers.”

An official from the Financial Supervisory Service said, “We are carrying out recovery efforts centered on backup data from before the ransomware infection,” and added, “It will be difficult to complete the recovery today or tomorrow.”