SGI scrambles to recover from ransomware attack

Headquarters of Seoul Guarantee Insurance in Seoul / Yonhap

Seoul Guarantee Insurance (SGI) plans to operate an around-the-clock response center and compensate all losses from a recent ransomware attack, the company said Wednesday.

The measures are the latest development in the fallout from Monday’s cyberattack that caused system disruptions and database suspension failures, including guarantee certificates issuance.

Also denied were consultations for SGI-mediated jeonse loans extended by commercial lenders.

Unique to Korea, jeonse is a home-renting system where tenants pay a lump sum refundable deposit in lieu of monthly rent.

The company said it will have the loans extended and the guarantees applied later, adding that its post-loan services are and will be fully available.

“We will run the center until no reports are filed,” the SGI said.

The center opened at 9 a.m. Wednesday to begin receiving reports on damages caused by the system failure.

Damages will be fully paid once claims are reviewed to match and verify facts.

Guarantee papers needed for court proceedings and biddings that require immediate issuance by small businesses and individuals are being manually issued at SGI branches.

“The center will make sure that all damages are fully compensated,” SGI said. “We will take responsible follow-up measures accordingly.”

Monday’s failure was similar to the attack used by a group of ransomware developers in April.

The group sent untraceable emails to the SGI demanding responses. The SGI refused, and turned the matter over to the Korea Financial Intelligence Unit under the Financial Services Commission.

The company held an emergency meeting around 7 a.m. Monday, with a focus on minimizing further damages and restoring the IT systems.

Since then, emergency response meetings have been held twice a day to address ongoing issues.

The SGI expects the system to recover by Thursday.

No evidence of data breach has been detected, according to the SGI.

The company said they are continuing to monitor the situation and will take further action depending on the results.