AI-Linked Cyberattacks Spread Across South Korea’s Financial Sector

South Korean financial authorities are preparing to reassess cybersecurity across the industry after a wave of attacks and intrusion attempts reached banks, savings banks, a credit-finance company and mutual finance networks.

Investigators are examining signs that attackers used artificial intelligence agents to probe financial companies for weaknesses. The Financial Services Commission and Financial Supervisory Service were due to convene association leaders and executives from affected firms for an emergency meeting in Seoul on Sunday. Officials are focusing on whether existing defenses can keep pace with automated attacks that search widely for vulnerable systems.

The Korea Federation of Community Credit Cooperatives reportedly detected access attempts from the same attacker internet addresses linked to a breach at Shinhan Bank. Its security systems blocked the abnormal overseas traffic, and no information was lost. A similar attempt against NongHyup’s mutual finance network was also repelled.

Other institutions reported confirmed exposure. Yegaram Savings Bank said an attack on Sept. 30 leaked names, birth dates and contact details belonging to about 40,000 customers. Hyundai Capital identified leaked personal information for 146 loan recruiters, while Welcome Savings Bank was investigating the scale and cause of a breach involving corporate customer data.

At Shinhan Bank, attackers targeted a service used by loan recruiters rather than the bank’s main customer-facing system. Information supplied to the National Assembly indicated that the activity ran for roughly 30 hours and exposed 25,727 personal-data records. The attackers generated valid customer numbers through repeated inputs and routed traffic through internet addresses in several countries.

KB Kookmin Bank was attacked through mobile support systems used by employees. Data obtained by a lawmaker’s office showed the activity continued for more than 42 hours and exposed 153 records, including employee information and customer names and phone numbers. Some encrypted resident registration numbers were also included.

Authorities have not yet established that every incident was conducted by one group or that AI was used in each attack. Similar timing and methods have raised the possibility of a common actor, but officials said attribution will take time. No matching attack traces had been found at securities, insurance or card companies, or at major state-owned banks, as of the report.

The incidents exposed a recurring weakness in secondary systems. Attackers focused on internal websites, staff applications and other support services that can have less stringent authentication than core banking platforms. Some affected firms have temporarily shut vulnerable satellite services and opened customer reporting channels while monitoring for secondary harm.

Regulators are also considering whether defensive AI requires changes to South Korea’s network-separation rules. Those rules isolate financial work systems from external networks, but authorities have been testing limited exemptions for firms with stronger safeguards. The latest attacks are likely to intensify debate over how to modernize that framework without creating new exposure.