South Korean Financial Firms Face Coordinated Cyberattacks as Regulators Probe AI Link

South Korean financial regulators have ordered emergency security measures after a wave of cyberattacks exposed personal information at seven financial companies, with investigators examining whether artificial intelligence helped automate the intrusions.

The Financial Services Commission convened an emergency meeting with industry leaders on Sunday and instructed financial firms to block external access to systems unless it is essential for business. The Financial Supervisory Service separately ordered companies to complete emergency security inspections by Thursday.

Shinhan Bank and Yegaram Savings Bank reported the largest known breaches, affecting about 25,000 and 40,000 people, respectively. Leaked loan application information at Shinhan included names, phone numbers, annual income and calculated borrowing limits.

Other confirmed cases were smaller but spread across different parts of the financial sector. KB Kookmin Bank reported 153 affected individuals, Hana Bank 89 and BNK Busan Bank 11 outsourced workers. Welcome Savings Bank reported 2,200 cases, while Hyundai Capital identified 146 affected people. Woori Bank and NH NongHyup Bank detected intrusion attempts but said their defenses blocked them without a data breach.

Authorities found the same internet protocol address in attacks against all seven companies where data was exposed, increasing suspicion that one attacker conducted a coordinated campaign. Investigators also found traces pointing to Artex, a Chinese-developed AI-based penetration-testing platform designed to find vulnerabilities and choose subsequent intrusion methods based on earlier results. Officials have not yet made a final determination that AI was used.

The attacks appear to have focused on less-protected support systems rather than the banks’ tightly secured core networks. Sales-support platforms were among the targets, illustrating how attackers can seek weaker links around institutions’ central infrastructure.

Financial Services Commission Chair Lee Eok-won said authorities could not rule out AI-assisted attacks and called for the highest level of vigilance. He said there was no indication that information directly usable for payments or other crimes had been leaked. However, officials warned that exposed personal details could still be exploited for voice phishing or fraudulent text messages.

Regulators now plan a broader overhaul of the financial sector’s security framework. The incident raises pressure on banks and nonbank lenders to strengthen oversight of peripheral systems as AI tools make it easier to scan for weaknesses and rapidly adjust attack methods.