South Korea probes bank breaches as sources dispute AI role

President Lee ordered a probe after South Korean bank breaches exposed tens of thousands of records; sources disagree on scale and ARTEX AI use.

On October 4, 2026, President Lee Jae Myung ordered a full investigation and sector-wide security checks after confirmed data breaches at South Korean banks and other financial firms; DataBreaches.net said the order also covered public institutions and quoted spokesperson Kang Yu-jung calling for countermeasures amid concern over AI-powered attacks. Shinhan Bank reported about 25,000 customers affected—The Decoder, citing newspaper Khan, said more than 25,000—including names, phone numbers, income, loan or credit limits and some resident registration numbers, and GBHackers said no payment credentials leaked and no unauthorized transactions were found. Victim counts disagree: Cyber Security News reported 119 records at KB Kookmin Bank and 89 at Hana Bank through internal support systems, about 40,000 customers at Yegaram Savings Bank, data on 146 housing-loan agents at Hyundai Capital and 11 outsourced workers at BNK Busan Bank, while BleepingComputer said Kookmin leaked credit-card information for 119,000 clients and described Hana only as a limited sales-support compromise. The Record said at least seven institutions exposed data on at least 68,000 people, close to GBHackers' roughly 65,000 total and inconsistent with the larger Kookmin figure. A Chinese-language string, "AI autonomous penetration testing console," on Shinhan-linked infrastructure was associated with open-source ARTEX AI; early outlets said use was unconfirmed and credential stuffing was suspected, The Record said officials believe AI agents and Artex AI were used, and The Decoder, citing CrowdStrike, said a suspected Chinese-speaking attacker used ARTEX—posted on GitHub in July and powered by DeepSeek v4.1-flash, GLM-5.3 and Grok 4.6—from late September to early October 2026, with Claude Code logs showing searches for Telegram groups to sell stolen data. The Financial Services Commission held an emergency meeting and ordered inspections, tighter access controls and threat sharing with KISA, and The Record said the Financial Supervisory Service traced 33 IP addresses across at least 12 countries, with a 28-investigator National Office of Investigation team leading the probe.

• On October 4, 2026, President Lee Jae Myung ordered a full investigation and sector-wide security checks after breaches at South Korean financial firms; DataBreaches.net said the order also covered public institutions, and spokesperson…
• Shinhan Bank reported about 25,000 customers affected (The Decoder, citing newspaper Khan, said more than 25,000), including names, phone numbers, income, loan or credit limits and some resident registration numbers; GBHackers said no…
• Counts conflict: Cyber Security News said KB Kookmin leaked 119 records and Hana 89 via internal support systems, Yegaram about 40,000 customers, Hyundai Capital data on 146 housing-loan agents and BNK Busan 11 outsourced workers;…
• The Record said at least seven institutions exposed data on at least 68,000 people, near GBHackers' roughly 65,000 figure and inconsistent with the 119,000 Kookmin claim.
• Shinhan-linked infrastructure carried a Chinese string, "AI autonomous penetration testing console," tied to open-source ARTEX AI; earlier reports left use unconfirmed and suspected credential stuffing, The Record said officials believe AI…
• Per The Decoder citing CrowdStrike, ARTEX was posted on GitHub in July and automates penetration testing with DeepSeek v4.1-flash, GLM-5.3 and Grok 4.6.
• The FSC held an emergency meeting and ordered inspections, tighter access controls and threat sharing with KISA; the FSS traced 33 IP addresses across at least 12 countries, and a 28-investigator National Office of Investigation team is…
• CrowdStrike described a suspected Chinese-speaking attacker active from late September to early October 2026 and Claude Code session logs searching Telegram groups to sell stolen data; an earlier report said a single campaign was…