South Korea’s financial regulators say they are dealing with what may be the first known case of AI agents being used to hack banks. The incidents surfaced on 30 September and have since spread from the country’s largest lenders to smaller savings banks and consumer finance firms.
Investigations are still under way. The AI link is a suspicion, not a finding.
What was taken
According to The Record, the affected companies include Hana Bank, KB Kookmin Bank and Shinhan Bank.
Shinhan has reportedly said personal data on roughly 25,000 customers was exposed.
The Korea Herald, as relayed by The Record, reported that the data covered borrowing history, income, phone numbers and names.
Korea JoongAng Daily puts the figures at
25,727 customers at Shinhan Bank, 119 at KB Kookmin Bank and 89 at Hana Bank
for the earlier breaches at major commercial banks. Some other outlets report a far larger KB Kookmin figure and a total above 144,000. That does not match the bank’s own announcement as reported by JoongAng, so treat the larger numbers with caution until regulators publish a count.
A report from the blog Mad Robot says Shinhan’s leak included 66 resident registration numbers, which are South Korea’s national ID numbers. It says the attacker got in by bypassing identity checks on a mobile service that loan agents use to track applications. That detail comes from a secondary source.
Why AI is suspected
Officials say
“signs have emerged”
that AI agents were used in at least some attacks. The Record quotes an official named Lee as saying it has become possible to hack with AI without specialised skills. Authorities have reportedly identified 33 IP addresses used in the intrusions.
Local reports have pointed to ARTEX AI, an open-source penetration-testing framework. Mun Chong-hyun of the security firm Genians told The Star that such tools, built for defence, can be a “double-edged sword” when they are turned to crime.
The banks were slow to notice. JoongAng reports detection took
15 hours 26 minutes at Shinhan, 41 hours 44 minutes at Hana and 67 hours 41 minutes at KB Kookmin
. Regulators named weak authentication and excessive data retention and access as key weaknesses, and warned of stern penalties for repeat failures.
The Financial Services Commission held an emergency meeting with banks and ordered lenders to check all systems reachable from outside their networks. Another meeting was planned for this week.
Practical steps for customers
No source reports stolen payment credentials or evidence that anyone can move money with the leaked data. The risk is what comes next. Income and loan-limit figures let scammers write messages that sound like they come from your bank or a loan broker.
- Treat unexpected calls, texts or links about loans, refinancing or “account problems” as suspect, even if the caller knows your income or loan limit.
- Hang up and call the number printed on your bank card or official app. Do not use a number the caller gives you.
- Never share one-time codes or install remote-access apps at a caller’s request.
- If your bank has contacted you about this breach, follow its instructions. Consider a credit report alert or freeze where your country offers one.
- Where national ID numbers may be exposed, watch for new accounts or loans in your name.
The attackers reportedly avoided internet banking itself. They came in through side systems: a loan-agent inquiry service, an employee mobile app and a sales support system. For customers, that means a bank’s front door can be secure while the data it shares with partners is not.
Readers outside Korea should note the wider point. If automated tools lower the skill needed to probe weak logins, firms with old or loosely guarded internal apps become easier targets. Customers can’t fix that, but they can make leaked details less useful by verifying every contact on their own.