South Korea Launches Major Probe Into Suspected AI-Assisted Financial Hacks
Police deployed 28 cyber investigators after data breaches were reported at seven South Korean financial institutions, while regulators ordered firms to check systems linked to 28 suspicious IP addresses.
South Korean police have opened a large-scale investigation into suspected artificial intelligence-assisted cyberattacks targeting financial institutions, after breaches exposed personal information belonging to tens of thousands of customers.
The Korean National Police Agency assigned 28 investigators in four teams from its cyberterrorism investigation unit to the case. The response follows reports of breaches at seven financial companies: Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital.
The combined exposure has been reported at roughly 66,000 individuals and 2,200 corporate records. Shinhan said information relating to 25,729 customers was affected, while Yegaram Savings Bank reported about 40,000 affected customers. The compromised data included names and telephone numbers, as well as resident registration numbers, annual income and loan limits in some cases.
Woori Bank and NH NongHyup Bank also reportedly encountered similar attacks, although no data leaks have been confirmed at those institutions.
The Financial Supervisory Service said it identified 28 distinct internet protocol addresses associated with the hacking attempts. It circulated the addresses to financial companies and instructed them to complete internal checks and fix security vulnerabilities by Thursday. The regulator cautioned that the addresses do not necessarily disclose the attackers’ actual locations because connections can be routed through other countries.
Authorities are also considering how the investigation fits South Korea’s reorganized criminal justice system. Police asked the Financial Services Commission to determine whether the affected systems qualify as electronic financial infrastructure. That classification will help decide whether the newly established Serious Crimes Investigation Agency must be notified and whether the case should be transferred.
President Lee Jae Myung called for a rapid government response during a Cabinet meeting. He urged officials to review protections for critical systems and accelerate the development and deployment of AI technology designed specifically for cybersecurity, arguing that defensive measures must keep pace with emerging threats.
A cybersecurity professor at Korea University said the attacks may have involved ARTEX, an AI-enabled tool used to identify security vulnerabilities. The possibility has not been presented by authorities as a final attribution, but it has intensified concern that increasingly accessible AI tools could lower the technical barrier to carrying out cyberattacks.
The investigation now has two immediate priorities: identifying those responsible and determining how the attackers moved across multiple institutions. Regulators, meanwhile, are pressing financial firms to close any shared weaknesses before additional customer information is exposed.