South Korea probes bank breaches amid suspected AI-powered attacks
South Korea is investigating confirmed data breaches at Shinhan, Kookmin, and Hana banks amid suspected AI-assisted attacks.
South Korea's Financial Services Commission held an emergency meeting after cyber incidents at major banks and confirmed a data breach at Shinhan Bank. Local reports say Shinhan exposed details of about 25,000 customers and KB Kookmin Bank leaked credit-card information for 119,000 clients, while Hana Bank suffered a limited compromise of a sales-support system. Authorities ordered inspections of externally accessible systems, tighter access controls, and rapid sharing of threat information with KISA. Yonhap reported that a server used in the attacks referenced ARTEX AI, an open-source agentic penetration-testing system, but banks and regulators have not confirmed that tool was used.
- FSC confirmed breaches at major South Korean banks after an emergency meeting.
- Shinhan reportedly exposed data on about 25,000 customers.
- Kookmin reportedly leaked credit-card data for 119,000 clients.
- Hana Bank's sales-support system suffered a limited compromise.
- ARTEX AI is suspected, but officials have not confirmed its use.
Full article391 words · extracted from bleepingcomputer.com · click to collapse
South Korea's Financial Services Commission (FSC) held an emergency meeting following a series of cyberattacks targeting financial institutions in the country.
During the meeting, officials confirmed a data breach at Shinhan Bank and said other cybersecurity incidents affected other South Korean banks, including Kookmin Bank.
Shinhan Bank and KB Kookmin Bank are large private South Korean commercial banks, each holding more than $400 billion in assets.
Authorities said they launched on-site investigations after receiving incident reports and shared all actionable information with relevant agencies, including KISA (Korea's data protection agency).
Financial companies in the country are now instructed to:
- Inspect all externally accessible IT systems and services, including those that are not customer-facing.
- Reduce unnecessary information exposure and check for missing or inadequate authentication and access controls.
- Quickly share threat information and coordinate their responses.
- Submit their internal security inspection results as soon as possible.
Authorities also pledged to oversee consumer protection and compensation, and analyze the incidents to identify necessary regulatory improvements.
Yesterday, local media outlets reported that South Korea's President Lee ordered a thorough investigation into personal data leaks at financial and public institutions.
At the same time, Hana Bank was also found to have suffered a limited-scope breach after its sales-support system was compromised.
According to the same reports, Shinhan Bank leaked the details of 25,000 customers, while Kookmin Bank leaked credit card information of 119,000 clients.
AI-powered attacks suspected
While official channels provided no details about the perpetrators, Korean news agency Yonhap reported that a server used in the attacks had an HTML page title containing a Chinese-language string associated with ARTEX AI.
ARTEX AI is an open-source penetration-testing system that uses agents to automate information gathering, vulnerability discovery, attack-path planning, security-tool execution, and vulnerability verification.
The bank and financial authorities have not confirmed its use in the Shinhan breach, and the Chinese-language string doesn't link the attacks to any particular threat actor.
However, Moon Jong-hyun, the head of the Genian Security Center, posted on LinkedIn that several threat analysts believe that the breaches involved AI-based attack automation tools.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.