South Korea: 3 Banks Breached Amid Suspected AI-Powered Attacks

South Korea's financial regulator has confirmed data breaches at Shinhan Bank, KB Kookmin Bank and Hana Bank, and police have opened a formal investigation into a series of cyberattacks on the country's financial institutions that local reporting links to a suspected AI-powered attack tool. The Financial Services Commission (FSC) held an emergency meeting and ordered on-site investigations after receiving incident reports from the affected banks, according to BleepingComputer, which published its report on October 5, 2026. The following day, South Korea's Yonhap News Agency reported that the National Office of Investigation (NOI) had formed a 28-member team to probe suspected violations of the information and communications network law, per Yonhap.

What was the specific vulnerability?

The confirmed facts are breaches of customer data at three major South Korean banks; the suspected vulnerability is the use of an AI-driven penetration-testing system by the attackers, a claim that remains unconfirmed. According to BleepingComputer, Shinhan Bank leaked the details of 25,000 customers, while KB Kookmin Bank leaked credit card information belonging to 119,000 clients, per local media reports. Hana Bank suffered a limited-scope breach after its sales-support system was compromised, with Yonhap reporting that 89 customers' personal information was leaked. Shinhan Bank and KB Kookmin Bank are large private South Korean commercial banks, each holding more than $400 billion in assets.

The AI angle rests on reporting by Yonhap, which found that a server used in the attacks carried an HTML page title containing a Chinese-language string associated with ARTEX AI, an open-source penetration-testing system that uses agents to automate information gathering, vulnerability discovery, attack-path planning, security-tool execution and vulnerability verification. Neither the banks nor the financial authorities have confirmed that ARTEX AI was used in the Shinhan breach, and the Chinese-language string does not by itself link the attacks to any particular threat actor. Moon Jong-hyun, head of the Genian Security Center, posted on LinkedIn that several threat analysts believe the breaches involved AI-based attack automation tools.

How was the incident detected?

The breaches were detected through incident reports filed by the affected banks, which triggered the FSC's emergency meeting and on-site investigations. According to BleepingComputer, authorities shared actionable information with KISA, Korea's data protection agency, after receiving the reports. The AI-tool lead emerged separately: Yonhap's reporting on the attacker server's HTML page title, and public analysis from threat analysts including Moon Jong-hyun of the Genian Security Center on LinkedIn. The timeline runs from the attacks and leaks in early October 2026, to the FSC emergency meeting and BleepingComputer's coverage on October 5, 2026, to the announcement of the police probe on October 6, 2026. South Korea's President Lee had already ordered a thorough investigation into personal data leaks at financial and public institutions, a step reported on October 4, per BleepingComputer.

What is the current impact?

The immediate impact is the exposure of personal and financial data belonging to a combined total of 144,089 customers across the three banks, alongside an active regulatory and criminal investigation. That combined figure is a sum of the three individually reported and dated figures: 25,000 Shinhan Bank customers whose details were leaked (BleepingComputer, October 5, 2026), 119,000 KB Kookmin Bank clients whose credit card information was leaked (BleepingComputer, October 5, 2026), and 89 Hana Bank customers whose personal information was leaked (Yonhap, October 6, 2026). According to BleepingComputer, Shinhan Bank's leak covered the details of 25,000 customers and KB Kookmin Bank's leak covered credit card information for 119,000 clients, while Yonhap reported the 89-customer leak from Hana Bank's limited-scope breach of its sales-support system. There is no software fix to report in this case: the response is investigative and regulatory, consisting of on-site investigations, mandatory security inspections of externally accessible systems and a 28-member police investigation team. No confirmation of the attack tool or attribution has been issued, and no details on credential rotation have been published.

What are the next steps?

The next steps are mandatory security inspections across the financial sector, a police investigation that may be escalated to a specialized agency, and regulatory review of the incidents. Financial companies have been instructed to inspect all externally accessible IT systems, including non-customer-facing ones, to reduce unnecessary information exposure, to check for missing or inadequate authentication and access controls, to share threat information quickly, and to submit internal security inspection results as soon as possible, according to BleepingComputer. Authorities have pledged to oversee consumer protection and compensation, and to analyze the incidents for regulatory improvements. On the law-enforcement side, officials are reviewing whether the case should be sent to the newly launched Serious Crime Investigation Agency, which handles cyber crimes against key state facilities and hacks into electronic financial infrastructure, per Yonhap. In a statement, the NOI said: "(We) will carry out an investigation swiftly and strictly while closely cooperating with relevant agencies to ease the public's anxiety."

By the numbers

Source snapshot