South Korea probes AI role in seven financial cyberattacks

President Lee Jae Myung ordered sector-wide security inspections after breaches exposed records at Shinhan Bank and six other institutions.

South Korean police opened a nationwide investigation into whether intruders deployed artificial intelligence models to breach seven financial institutions and steal customer records.¹²

The inquiry follows warnings from President Lee Jae Myung, who told a cabinet meeting that investigators detected indications of automated software during recent intrusions across the country's banking system.³¹ Lee instructed government agencies to determine the origin of the intrusions rapidly, urging officials to concentrate personnel and resources on containing fallout from the compromised systems.³

"In some hacking incidents, signs have emerged of AI being used, causing considerable public concern and anxiety," Lee said during the cabinet meeting.³ "Please establish the circumstances swiftly and clearly, and concentrate personnel and resources on minimising the damage."³ Presidential spokesperson Kang Yu-jung added that the administration directed regulatory bodies to treat the breaches with urgency and assemble defensive protocols.⁴⁵

The wave of intrusions compromised personal records across major commercial lenders and secondary credit institutions.⁴⁵ Shinhan Bank confirmed that unauthorized actors extracted personal details belonging to roughly 25,000 customers, including names, telephone numbers, and annual income figures.⁴⁵ Hana Bank disclosed leaks affecting 89 individuals, while KB Kookmin Bank reported that data associated with 119 people had been compromised.⁴ Regional lender BNK Busan Bank identified a breach that exposed the personal data of 11 outsourced software developers.⁴

Secondary financial institutions reported substantial exposures as well.⁴ Yegaram Savings Bank, which operates outside the primary banking statute, confirmed that records covering approximately 40,000 customers had been compromised.⁴ Consumer lender Hyundai Capital disclosed that intruders accessed details for 146 mortgage loan agents, while Welcome Savings Bank identified an unauthorized extraction of approximately 2,200 records involving corporate clients, such as corporate representatives' names, email addresses, and contact numbers.⁴²

State-owned policy institutions and investment firms appear unblemished by the current wave.⁴ Neither state policy lenders such as the Industrial Bank of Korea and the Export-Import Bank of Korea nor insurance firms, brokerage houses, and credit card companies detected evidence of intrusions inside their perimeters.⁴

Financial regulators convened emergency weekend discussions at the Government Complex Seoul to assess perimeter vulnerabilities across the industry.⁴ Financial Services Commission Chairman Lee Eog-weon met with Financial Supervisory Service Governor Lee Chan-jin, heads of trade associations, and senior executives from each compromised firm.⁴ The regulatory leadership instructed commercial banks and card issuers to complete comprehensive audits of their digital infrastructure by Oct. 6, giving securities firms, insurers, and savings institutions until Oct. 8 to finish inspections.²

"We have detected multiple security breaches across various sectors in a short span of time, not only at major commercial banks but also at savings banks and specialized credit finance firms," Lee Eog-weon said during the regulatory meeting.⁵ "The entire financial sector needs to maintain the highest level of vigilance over these breaches."⁴

Regulators emphasized that the intruders bypassed core transaction infrastructure, leaving payment clearing channels untouched.⁵² The intrusions targeted auxiliary external platforms, including web servers and mobile hardware operated by third-party loan brokers and staff members.² Attackers established backdoors by installing malicious code onto peripheral servers, seizing administrative privileges, and extracting stored credentials.²

Technical investigators traced the intrusions to common network origins, discovering that the same attacker Internet Protocol address appeared across separate breach locations.² The perpetrators rotated routing addresses continuously during active exfiltration sessions.² Regulators noted that while credentials capable of authorizing fund transfers remained secure, the stolen identities could support targeted voice phishing campaigns.⁵

"We cannot rule out the possibility of hacking attacks utilizing AI," Lee Eog-weon said.² "We must hurry to establish a security system that defends against AI attacks with AI."²

South Korean authorities have not yet released specific technical profiles detailing the automated systems or commercial language models suspected in the breaches.³ The incident aligns with rising international concern regarding synthetic cyber operations.³ Australian authorities confirmed that an autonomous agent infiltrated a government health portal in June, and researchers observed similar automated intrusion attempts targeting public Canadian infrastructure.

What this rests on

30 sentences trace to 5 sources.

All 5Documents 1Records 0Reporting 4People 0

1. 1 N nytimes.com Document · nytimes.com · 6 Oct 2026 South Korea Investigates Possible AI Use in Hacks on Banks See the source
2. 2 SN SBS NEWS Third-party reporting · news.sbs.co.kr · 4 Oct 2026 7 Financial Institutions Hit by AI Hacking... Emergency Meeting Called See the source
3. 3 TS The Star Third-party reporting · thestar.com.my · 6 Oct 2026 South Korea's Lee says AI appears to have been used in bank hacks See the source
4. 4 K koreajoongangdaily Third-party reporting · koreajoongangdaily.com · 4 Oct 2026 Lee demands thorough probe as series of cyberattacks hit Korea See the source
5. 5 AA Anadolu Ajansı Third-party reporting · aa.com.tr · 4 Oct 2026 South Korean president calls for thorough probe into bank hacking attacks See the source