The biggest disclosure came from the smallest institution. Yegaram Savings Bank, a lender few outside South Korea would recognize, told regulators that roughly 40,000 customer records had been taken. A few days earlier, Shinhan Bank, one of the country’s largest lenders, put its own number at about 25,000. Between late September and early October, a run of intrusions touched seven financial firms, and the country’s president said there were signs that artificial-intelligence models had been used.
The affected institutions span the sector. Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Welcome Savings Bank, Yegaram Savings Bank and Hyundai Capital all confirmed breaches, according to financial authorities. The losses were uneven: KB Kookmin reported data on 119 customers, Hana 89 and BNK Busan 11. Shinhan’s roughly 25,000 records and Yegaram’s 40,000 accounted for most of the damage.
What the hackers did not hit is as notable as what they did. The intrusions stayed away from core payment systems and the customer-facing internet and mobile banking platforms that carry the largest security budgets. Instead they went through softer doors: a loan-progress inquiry service used by loan brokers at Shinhan, an internal mobile work-support system for employees at Kookmin, and similar peripheral portals at other firms.
Authorities say the attacks appear to have used an AI-assisted approach. Investigators found traces of a penetration-testing tool called ARTEX, believed to have been developed in China and made public only a couple of months ago. The tool can call on large language models including Anthropic’s Claude and OpenAI’s GPT, and it picks its next intrusion method based on how the previous one fared. Built to help organizations find their own weaknesses, it was repurposed to scan for vulnerabilities, rotate IP addresses and slip past authentication checks.
President Lee Jae-myung, who said “signs have emerged” that AI models were involved, ordered a full investigation and stronger security measures. Lee Eog-weon, the chairman of the Financial Services Commission, told an emergency meeting in Seoul that financial firms should block external access by default and allow it only where necessary. The Financial Supervisory Service alerted roughly 500 institutions to malicious IP addresses tied to the attacks.
The attackers reached South Korea through a tangle of foreign servers. Korean media reported that the intruders routed their traffic through more than 20 IP addresses across 10-plus countries, including the United States, Japan and Germany. No group has claimed the campaign, and the identity of those behind it has not been confirmed. One official said the possibility of a single actor could not be ruled out.
For the banks, the episode exposes a gap between the defenses built for customer-facing systems and the weaker protections around the tools employees and intermediaries use every day. The intrusions came through loan portals, business-support systems and mobile office software, the secondary systems that multiplied during years of digitization and were never hardened to the same standard as the core.
Detection was slow. Shinhan took roughly 15 hours to identify its breach, Hana about 42 hours and KB Kookmin about 68 hours, according to local reporting. That lag is its own problem: an automated campaign that moves across institutions at machine speed can do a great deal of damage in the time it takes a bank to notice it has been hit.
The campaign also shifts the profile of who can attack a bank. The tools that once required a team of skilled hackers are now, in part, available to anyone who can point an AI model at a list of targets and let it probe. Analysts said that lowers the barrier to entry for financial cybercrime and changes the math for defenders, who must now watch every secondary system, not just the core.
The exposure, tens of thousands of names, phone numbers, resident registration numbers and loan details, is the immediate concern. No customer financial losses had been confirmed as of early October, but the stolen information is the raw material for fraud, and regulators launched a monthlong prevention effort alongside a consumer alert.
The government’s response has been swift, but the damage is already a matter of public record. Woori Bank and NH Nonghyup Bank reported abnormal activity but no confirmed data loss, leaving the confirmed count at seven firms. Regulators ordered emergency security checks across the industry and said any gaps found must be closed immediately.
The episode is a case study in how quickly a familiar threat turns new. Brute-force probing of customer databases is an old tactic. Automating it with an AI model that selects its next step and hides its tracks is something else. South Korea’s banks are now racing to close the doors that the tool found open.
