The Pulse
South Korea Orders Bank Audits as Police Probe AI-Suspected Hacks
South Korean police opened a preliminary inquiry on October 2 into a series of bank data breaches, while the Financial Services Commission ordered financial firms to check exposed systems. Investigators have not confirmed that AI tools were
AI.info Team · Written with AI ·
South Korean police opened a preliminary inquiry into a wave of bank data breaches on October 2, even as the suspected role of artificial intelligence remains unproven. The incidents exposed customer information at several lenders, and a suspected AI penetration-testing tool left traces on a server linked to one attack. But authorities and the banks have not confirmed that the tool was used to steal data.
ARTEX AI traces raise a question, not an answer
Shinhan Bank said on September 30 that an unauthorized outsider had bypassed identity checks in its loan-broker service and exposed information belonging to about 25,000 customers. The leaked data included names, annual income and resident registration numbers, according to Seoul Economic Daily’s report. The suspected method was credential stuffing: trying large sets of previously obtained login details against a service.
Security analysts pointed to a Chinese-language string referring to an “AI autonomous penetration testing console” in the HTML title of a web server believed to have been involved in the Shinhan attack. The string was associated with ARTEX AI, an open-source system designed to automate tasks such as vulnerability searches and attack-path planning. Yonhap reported that investigators had not established whether ARTEX AI was actually used in the breach.
That distinction matters: evidence that a tool’s name appeared on a suspected attack server is not proof that the tool carried out the intrusion. The reported evidence has prompted security experts to consider AI-assisted automation, while the specific technique attributed to the Shinhan breach remains credential stuffing. The available reporting does not establish who operated the server or whether the suspected AI system played a role in extracting customer records.
Breaches spread beyond Shinhan
KB Kookmin Bank disclosed a separate incident affecting 119 customers, with exposed information including names, phone numbers, addresses and encrypted resident registration numbers. Yonhap also reported a breach at Hana Bank affecting 89 customers, whose exposed data included names, addresses, phone numbers and resident registration numbers. The incidents involved customer information, not a reported breach of the banks’ core transaction systems.
Woori Bank and NH Nonghyup Bank also faced hacking attempts, but blocked unauthorized access without confirmed customer-data leaks, Yonhap reported. Police began a preliminary inquiry into the series on October 2, naming Shinhan, KB Kookmin, Hana and BNK Busan Bank among institutions whose hacking-related damage had become public. The inquiry is preliminary; the reports do not say police have determined that AI was used.
Regulators order checks of exposed systems
The Financial Services Commission held an emergency meeting with financial regulators, security officials and industry representatives on October 2. It directed financial firms to immediately review systems and services accessible from outside their networks, check authentication and access controls, and reduce unnecessary exposure of internal information. The commission also called for rapid sharing of attack indicators, including suspicious IP addresses and methods, so other institutions could respond to similar attempts.
The regulator said it would provide a security checklist and require firms to report their review results. Its response focuses on reachable systems and access controls, regardless of whether a service faces customers directly. That scope reflects a key point in the breaches: attackers can reach customer information through supporting services and employee tools, not only through a bank’s main transaction platform.
Weak controls remain the immediate concern
Experts cited by Seoul Economic Daily pointed to gaps in authentication, monitoring and oversight of outside vendors alongside the possibility of automated attacks. Son Kyu-sik, a professor in the Department of Hacking and Security at Hanyang Cyber University, said systems exposed to the public internet with weaker authentication can be vulnerable to automated attacks. The report also noted that banks’ reliance on separating internal and external networks may not fully address risks posed by services operating on external networks.
“The reality is that the existing procedures for building security systems are not keeping pace with the speed at which AI attack technology is advancing,”
Lee Sang-geun, professor in the Department of Smart Security at Korea University’s Graduate School of Information Security
The English edition identifies its text as an AI translation from Korean and cautions that translated quotations may not reflect the original wording exactly. For now, the confirmed facts are a string linked to an AI security tool on a suspected server, several bank data leaks, and a police inquiry launched as regulators ordered system-wide checks. The Financial Services Commission’s next concrete step is to collect banks’ review results.