South Korea probes possible AI role in attacks on banks

South Korea was investigating on Oct 6 whether artificial-intelligence models were used in recent cyberattacks on banks, after customer information was exposed at several institutions. President Lee Jae Myung said signs of AI use had appeared in some incidents and called for the circumstances to be established quickly, while police and financial regulators pursued separate inquiries.¹³⁴

Customer information exposed

Shinhan Bank said an outside party gained unauthorised access to certain services and obtained information belonging to about 25,000 customers. The compromised data included names, telephone numbers and annual income. According to reporting cited by The Straits Times, attackers may have used advanced AI agents to test for weaknesses and enter a service used by loan recruiters.²³

KB Kookmin Bank reported that an external intrusion exposed personal information relating to 119 customers, while 89 Hana Bank customers were affected by another attack. According to Yonhap, Woori and NH Nonghyup also faced attempted attacks, but each prevented the intrusions and neither reported a customer-data leak.²³

On Oct 5, The Korea Times said data breaches reported by seven financial firms had affected over 67,000 individuals. It said the incidents exposed both personal and financial information, while investigators had identified traces associated with ARTEX AI on infrastructure believed to have been involved in the campaign.⁷

Evidence under examination

The Financial Supervisory Service and the Financial Security Institute identified 28 distinct IP addresses associated with recent hacking attempts and distributed the information to the financial sector. Yonhap reported that the watchdog believed the shortlisted addresses had been used in hacking supported by AI agents. Investigators linked the IP addresses to the US, Japan and a further 10 countries, while being unable to establish the origin of some.¹³

That assessment has not established publicly which AI systems, if any, were deployed. Authorities have not disclosed the specific tools or the complete scale of the breaches. The Korea Times report about ARTEX AI described traces found on suspected infrastructure, rather than establishing publicly that the technology carried out the intrusions.¹⁷

President Lee said the indications of AI use had generated concern and instructed officials to determine what happened and limit the damage. He also called for cybersecurity approaches suited to an era in which AI can be used in attacks. The president’s comments did not identify a particular model or developer.¹²³

Regulatory and police response

The Financial Services Commission convened an emergency meeting on Oct 2 with regulators, major banks, card companies and industry associations. It ordered financial companies to examine every system accessible from outside, regardless of the service type, and to check that authentication and access controls protecting internal information were adequate. The commission also directed institutions to share attacker addresses, methods and intrusion records rapidly.⁵

Following reports of the attacks, the Financial Supervisory Service launched an urgent field inspection at Shinhan, and the Financial Services Commission, the FSS and the Financial Security Institute opened inquiries. The Kyunghyang Shinmun reported that police initially opened a pre-case inquiry involving several banks; subsequent reports said police had begun a full investigation.²⁵⁶