South Korea Probes Bank Hacks, AI Tools Suspected
South Korea's Financial Services Commission held an emergency meeting after a series of cyberattacks on the country's banks, with security analysts suspecting the attackers used AI-based automation tools.
Key facts
What happened: Confirmed data breach at Shinhan Bank, plus incidents affecting other South Korean banks including KB Kookmin Bank
Reported scale: Shinhan leaked details of 25,000 customers; Kookmin leaked credit card information for 119,000 clients, per local media
Also affected: Hana Bank suffered a limited-scope breach after its sales-support system was compromised
The banks: Shinhan and KB Kookmin are large commercial banks, each holding more than $400 billion in assets
The AI angle: A server used in the attacks carried an HTML page title containing a Chinese-language string associated with ARTEX AI, an open-source penetration-testing system
Official response: On-site investigations launched; President Lee ordered a thorough investigation into data leaks at financial and public institutions
What are South Korean regulators requiring?
The FSC has instructed financial companies in the country to take four specific actions:
Inspect all externally accessible IT systems and services, including those that are not customer-facing
Reduce unnecessary information exposure and check for missing or inadequate authentication and access controls
Quickly share threat information and coordinate responses
Submit internal security inspection results as soon as possible
Authorities also pledged to oversee consumer protection and compensation, and to analyze the incidents for necessary regulatory improvements.
That first instruction is the notable one. "Including those that are not customer-facing" suggests regulators believe the way in was through systems nobody thought of as exposed — which matches the Hana Bank incident, where a sales-support system was the entry point.
How strong is the AI evidence?
Suggestive, not conclusive — and worth stating carefully.
Korean news agency Yonhap reported that a server used in the attacks had an HTML page title containing a Chinese-language string associated with ARTEX AI. ARTEX AI is an open-source penetration-testing system that uses agents to automate information gathering, vulnerability discovery, attack-path planning, security-tool execution and vulnerability verification.
The banks and financial authorities have not confirmed its use in the Shinhan breach, and the Chinese-language string does not link the attacks to any particular threat actor.
Moon Jong-hyun, head of the Genian Security Center, posted that several threat analysts believe the breaches involved AI-based attack automation tools.
So: a plausible indicator, analysts leaning that way, and no official confirmation. Treat reports stating flatly that AI carried out these attacks with caution.
Why automated attack tools change the math for defenders
Penetration-testing automation does what a skilled human tester does — map systems, find weaknesses, plan a route, verify it works — without the human time cost. A tester who could assess a handful of systems in a week can, with these tools, assess thousands.
For defenders, that erodes a defense nobody names: obscurity through effort. Systems that were technically exposed but unlikely to be found, because finding them wasn't worth anyone's time, are now worth finding.
The FSC's instruction to inspect everything externally accessible, customer-facing or not, is precisely the right response to that shift.
What businesses elsewhere should take from this
Make a list of every system of yours reachable from the internet — including the ones that exist for staff, partners or suppliers rather than customers. Those are the systems that typically lack the scrutiny customer-facing ones get, and they are what automated discovery finds first.