South Korean financial institutions and state databases face a severe cybersecurity crisis following a widespread campaign of automated hacking attacks and widespread identity leaks, regulators have warned.
The intrusions first came to light on October 1, when Shinhan Bank (055550.KS) detected unauthorised access to loan application records. The exposed data included customer names, phone numbers, declared annual incomes, and pre-calculated borrowing limits, affecting roughly 25,000 individuals. The discovery prompted the Financial Supervisory Service (FSS) to launch an immediate on-site investigation, while the lender moved to isolate compromised network paths and restrict incoming external traffic.
The cyber offensive quickly spread across the country's banking landscape. Seven financial institutions suffered verified perimeter breaches, The Korea Herald reports. It was then revealed that unlisted lender Yegaram Savings Bank suffered the largest exposure, with 40,000 customer files compromised. At the same time KB Financial Group's (105560.KS) KB Kookmin Bank reported a further 119 to 153 affected individuals. Capital lender Hyundai Capital registered 146 exposed files, Hana Financial Group's (086790.KS) Hana Bank recorded 89, and BNK Financial Group's (138930.KS) BNK Busan Bank confirmed the leak of 11 outsourced personnel records.
Unlisted Welcome Savings Bank noted 2,200 more compromised entries. Meanwhile, Woori Financial Group (316140.KS) and NH NongHyup Bank successfully blocked external intrusion attempts without reporting data loss.
AI agent deployment
According to Reuters, the technical mechanics of the campaign point to a sophisticated, single adversary using artificial intelligence agents to scale intrusion capabilities across multiple victims simultaneously. Cyber forensic investigators identified traces of ARTEX, a Chinese-developed AI penetration-testing platform, across all seven breached institutions.
ARTEX was published on GitHub this year by a Chinese security engineer using the handle Autumn. Rather than operating as a standalone large language model (LLM), the open-source software connects to external LLMs to probe external endpoints, evaluate defensive responses, and iteratively alter its intrusion tactics to bypass security parameters. Then, instead of attempting direct attacks against core banking databases, the software targets less-protected peripheral systems, such as third-party mobile sales support software used by loan agents.
US cybersecurity firm CrowdStrike (CRWD) reported on October 7 that the adversary was likely a financially motivated 26-year-old Chinese speaker based in Guangdong province. CrowdStrike (CRWD) uncovered personal details linked to the suspect while analysing AI coding-tool sessions and infrastructure associated with the campaign, which deployed ARTEX backed by DeepSeek v4.1-flash, Anthropic’s Claude Code, Zhipu AI’s GLM-5.3, and xAI’s Grok 4.6.
In one captured Claude Code session, the suspect asked where threat actors typically sell Korean data breach information and requested assistance in finding Korean Telegram data sales groups. In another session, the same person asked Claude to generate a security researcher resume that contained specific personal details, including a location in Maoming, a city in Guangdong, an age of 26, a contact phone number, and a Telegram handle. When contacted via the phone number, a man said he had no knowledge of the matter, while Chinese foreign ministry spokesperson Mao Ning told a regular press briefing that Beijing was not familiar with the case and consistently opposes hacking.
The scale of the attack prompted direct intervention from the highest levels of government. President Lee Jae Myung ordered a thorough investigation into the breaches, Yonhap News Agency reported. Financial Services Commission (FSC) Chairman Lee Eok-won subsequently convened an emergency summit with industry leaders on October 5, ordering financial firms to restrict external network access to non-essential systems and enforce immediate operational checks. The incident mirrors a broader global trend of AI-driven breaches, including Australia’s disclosure last month that an OpenAI autonomous agent breached a government health statistics portal in June, forcing cyber insurance underwriters to re-examine whether autonomous AI systems fit traditional definitions of a cyber attacker.
While the FSC confirmed that transaction passwords, payment tokens, and primary account credentials remained secure, regulators warned that the leaked loan data and phone numbers could feed organised voice-phishing and text-fraud operations across the country.
Tracing the perpetrators has proven exceptionally difficult due to complex network obfuscation. The FSS identified 28 specific internet protocol (IP) addresses tied to the hacking campaign, but police investigations confirmed that the majority were indirect proxy servers used to mask the attackers' true location, The Korea Times reported on October 7. The National Police Agency in South Korea has since formed a 28-member cyber-investigation team working alongside international law enforcement agencies to track the multi-node routing paths.
Systemic vulnerabilities
The banking breaches follow parliamentary revelations exposing systemic vulnerabilities in South Korea's handling of core citizen identification data. Resident registration numbers were exposed over 5.05mn times across 130 enforcement cases handled by the Personal Information Protection Commission (PIPC) and the FSS between 2021 and September 2026, according to an official analysis by Representative Han Chang-min of the Social Democratic Party, covered by The Korea Times.
The compiled regulatory data showed severe perimeter failures spanning both public institutions and major commercial corporations:
Public agency National Centre for the Rights of the Child logged the largest exposure, recording 1.16mn compromised resident registration numbers across three separate breach incidents;
Unlisted travel portal Yanolja suffered 1mn exposed records, along with 1mn compromised duplication information (DI) keys;
Digital services firm NHN (181710.KS) subsidiary NHN Wetoo accounted for 524,620 exposed identity entries;
Lotte Card registered 452,313 leaked resident registration numbers and 836,382 connecting information (CI) keys;
Matchmaking firm Duo Information and telecommunications provider LG Uplus (032640.KS) recorded 427,464 and 297,117 encrypted record exposures, respectively.
Beyond resident registration numbers, the parliamentary analysis documented more than 2.78mn leaks involving specialised cryptographic keys, specifically Connecting Information (CI) and Duplication Information (DI). DI keys verify whether an individual holds multiple accounts on a single site, whereas CI keys act as universal online identity markers generated directly from resident registration numbers. Their exposure creates significant secondary fraud risks, allowing bad actors to cross-reference leaked datasets and fake user identities across different digital platforms.
The cyberattacks have reignited public scrutiny over whether South Korea's top commercial banks, despite reporting record profits, are committing adequate capital to infrastructure defence. For the current fiscal year, KB Kookmin Bank allocated KRW86.07bn ($64.2mn) to information security, leading the commercial banking sector. Hana Bank spent KRW63.63bn, while Woori Bank set aside KRW61.56bn. By contrast, Shinhan Bank recorded the lowest security allocation among the top four commercial lenders at KRW40.59bn, up modestly from KRW36.9bn in the previous period.
Although regulators noted that security budgets do not single-handedly determine resilience against automated attacks, the FSC pointed to the fact that institutional defensive frameworks require fundamental updates. As automated, AI-powered penetration platforms become accessible to cybercriminals, regulatory focus is shifting toward mandatory access controls, continuous threat detection, and the strict isolation of non-core administrative endpoints to prevent further widespread systemic compromise.
