'N. Korea responsible for latest online mall hacking,' say police

South Korean police said Thursday that North Korea was responsible for the latest hacking and blackmailing of Interpark, a major online shopping mall. Police pay attention to the first case in which North Korea demanded money after conducting cyber terrorism, believing that Pyongyang could have attempted to secure foreign currencies amid international sanctions on the communist state.

Police said the North also demanded money after hacking a South Korean nuclear power plant in December 2014 but did not specify how much money it was seeking. Police view the 2014 case as part of Pyongyang’s psychological operation aimed at creating anxiety among the South Korean public.

A joint investigation team involving the police and the government, announced that the hackers who stole personal information of 10.3 million Interpark customers and demanded bitcoins, a form of digital currency, worth 3 billion won (2.7 million U.S. dollars) belonged to North Korea’s Reconnaissance General Bureau. Police said the four Internet Protocol (IP) addresses used by the hackers were identical to those used in previous hacking cases involving the North Korean Ministry of Post and Telecommunications hackers.

“While investigating other hacking cases involving the Ministry of Post and Telecommunications, we found that the IP addresses were the same as those used in the Interpark hacking,” said an official at Seoul’s National Police Agency. “The investigation result cannot change.” The IP addresses were used in the distributed denial-of-service attack on July 7, 2009.

In addition, police said that the malicious codes used were also identical to past examples of North Korean cyber-attacks and that the blackmailing e-mail message included used only in the North.

After the North Korean hackers obtained the customer data from Interpark in May, they sent 34 e-mails to a company executive from July 4, asking for 3 billion won worth of bitcoins, police said. The virtual currency exchangeable online is often used in cybercrimes as it leaves no transaction trails. “It seems that North Korea has shifted it cyber terror tactics from attacking (South Korea’s) national infrastructure to targeting the (South Korean) people’s wealth to earn foreign cash,” a police official noted.

박훈상기자 tigermask@donga.com