Video
[Anchor]
So, who exactly do these clues point to? Our reporting team reached out to the Chinese mobile phone number and Telegram account left in the report. This individual denied any involvement in the hacking, claiming that his personal information had been stolen.
Reporter Choi Seung-hun continues the coverage.
[Reporter]
This is the Chinese mobile phone number that appeared in the CrowdStrike report.
When the SBS reporting team called directly, a man presumed to be Chinese answered.
[Chinese Phone Number Recipient: I am not a hacker. What are you talking about? Is this a scam call?]
While the report stated that the suspected hacker attended South China University of Technology, a prestigious Chinese university, the person on the other end of the call said he dropped out.
[Chinese Phone Number Recipient: I dropped out of school. (Are you not a software engineer?) No, I am not.]
Contrary to the report's claim that he resides in Maoming, Guangdong Province, the respondent stated that he was located in Hunan Province, about 900 kilometers away.
[Chinese Phone Number Recipient: I am in Changsha (Hunan Province). Changsha. I am in Changsha.]
Next, we sent a message to the Telegram account "YY" listed in the report.
The operator of the account confirmed that he uses the account, but claimed that the phone number in the report does not belong to him.
He stated that his place of residence is Zhengzhou, Henan Province, which is neither Guangdong Province as stated in the report nor Hunan Province where the phone number user is located.
He claimed that someone had stolen his personal information, adding that he suspects someone with whom he recently had a conflict.
He also said, "I hope the South Korean side investigates thoroughly and does not implicate me."
Shortly afterward, the Telegram account was deleted.
The account was also found in an announcement from a Chinese-language Telegram community.
It was a community related to DDoS attacks, which paralyze services through massive connection attempts, and this account was registered as an administrator.
However, there is also the possibility that the hacker left the information of an unrelated person online to evade tracking.
Police explained that while this identity-related information serves as an investigative clue, it requires verification, and they are tracking the suspects while keeping all possibilities open, including the attacker's nationality, operational region, and whether they acted alone.
(Video Editor: Park Na-young, VJ: Lee Ji-hwan, Design: Park Chun-woong)