The Pulse
South Korea Opens Probe Into Suspected AI-Assisted Attacks on Seven Firms
South Korean police opened a formal investigation on October 6 into breaches affecting seven financial firms, as officials examine whether attackers used the ARTEX AI penetration-testing tool. Regulators say exposed customer data could fuel
AI.info Team · Written with AI ·
South Korean President Lee Jae Myung says signs point to AI agents in at least some attacks on financial firms. Investigators have found traces linked to ARTEX AI, but that does not establish who used the tool—or prove that AI carried out every breach. On October 6, police opened a formal investigation into incidents reported by seven financial companies, while regulators warned that exposed personal data could become material for phishing scams.
Police assign 28 investigators to the case
The National Police Agency’s National Office of Investigation assigned four cyberterrorism investigation teams, 28 investigators in total, to the inquiry. Police opened the case under South Korea’s Information and Communications Network Act and are tracing internet addresses used in the attacks, including those located overseas. The first reported incident in the cluster involved Shinhan Bank on September 28; the bank’s breach was reported to authorities on September 30. Korea JoongAng Daily reported that investigators are also checking whether the case should be referred to the Serious Crimes Investigation Agency.
The affected companies include Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital. Reports put the number of people whose information was exposed at more than 67,000; The Record cited a figure of at least 68,000. The Korea Times reported that the data included names, contact details, resident registration numbers, annual income and loan limits.
ARTEX traces do not identify the attackers
Investigators found traces associated with ARTEX AI, described by The Korea Times as an open-source, Chinese-language autonomous penetration-testing system, on a server believed to have been used in the attacks. Finding traces of the tool is not proof that it executed the intrusions, nor does it show that the attackers were Chinese. The Korea JoongAng Daily reported that the tool is open source and cannot, by itself, identify who was behind the breaches.
Lee’s remarks signal a concern about what automation may have contributed, not a final investigative finding. “Signs have emerged” suggesting AI agents were used in at least some attacks, he said, according to The Record. The distinction matters: officials are probing a possible role for AI while investigators continue to establish how the attacks happened and who carried them out.
Regulators target overlooked access points
South Korea’s Financial Services Commission said it began examining the Shinhan incident after receiving the bank’s report on September 30, then expanded its response as other firms reported intrusions. At an October 4 emergency meeting attended by financial regulators, police and other agencies, officials called on firms across the sector to review exposed IT assets, vulnerabilities, authentication and access controls, and their ability to detect intrusions. The commission also instructed firms to check that shared attack information had reached their detection and blocking systems and that necessary security patches were in place.
The regulator’s focus includes systems used by employees, loan agents and outside contractors—not only banks’ main customer-facing services. It urged firms to limit external access, restrict the information those systems can view and check for missing or bypassable authentication steps. Those measures reflect the concern that routes connected to partners and support operations can expose customer records even when core banking systems are not the direct target.
Officials report no stolen funds so far
On October 6, the financial regulator and Financial Supervisory Service issued a consumer alert about follow-on scams. The commission said passwords and one-time passcodes were not exposed and that authorities had not confirmed customer money being taken in connection with the data breaches. It also said there was no confirmed exposure of information directly usable to conduct financial transactions, while warning that leaked personal details could still help scammers pose as bank staff or offer fake loans.
Regulators ordered affected companies to run dedicated support channels for customers and strengthen monitoring for suspicious transactions that combine exposed personal information. They urged consumers to distrust messages asking for advance loan payments, transfers to “protect” an account or installation of an app. Police continue to trace the attack infrastructure; the investigation has not yet established that AI agents caused all seven breaches.