After SGI, Welcome Financial Also Hit by Ransomware Attack: "No Personal Information Leaked"

"Emergency Response System Activated Immediately After Incident... Security and Defense Measures Implemented"

Following Yes24 and SGI Seoul Guarantee, Welcome Financial Group has also been targeted by a ransomware hacking attack.

According to the financial sector on August 18, Welrix F&I Loan, a lending subsidiary of Welcome Financial Group, recently suffered a ransomware attack from an overseas hacker organization and is currently investigating whether customer information was leaked.

Welcome Financial stated, "We activated our emergency response system immediately after the incident and have recovered some of the damages," adding, "We have also implemented additional security inspection measures."

Photo of Welcome Savings Bank in Junggu, Seoul. Photo by Jinhyung Kang aymsdream@

The hacking occurred on a personal computer at Welrix F&I Loan. Welcome Financial reported the incident to the Korea Internet & Security Agency (KISA) and financial authorities immediately after it happened, and is currently implementing security and defense measures. In addition, the company is checking whether any other subsidiaries have also been affected by hacking.

A Russian-affiliated hacker group has claimed responsibility for the attack via the dark web. They claim to have obtained 1.02 terabytes (TB) of internal data, approximately 1.39 million files, including customer names, dates of birth, addresses, and account information from Welcome Financial.

However, Welcome Financial explained that the compromised files were not customer information, but rather approval documents, meeting materials, and similar files. The company also confirmed that, so far, no other subsidiaries have been affected.

Welcome Financial stated, "As of now, we have not identified any leakage of personal information," and added, "We will take proactive measures if any such issues are discovered in the future." The company also said, "We reported the incident to KISA immediately and are implementing security and defense measures," emphasizing that "the core network infrastructure of Welcome Financial Group has not been affected, and this cyberattack is unrelated to Welcome Savings Bank."