Seoul and CrowdStrike tie ARTEX AI to bank breaches

Seoul and CrowdStrike say a suspected Chinese-speaking operator used the ARTEX AI tool to steal data from multiple South Korean financial firms in late 2026.

South Korean President Lee Jae Myung said officials were investigating financial-institution breaches in which AI agents, including the Chinese tool ARTEX (also called Artex AI), were suspected. The Record reported at least seven institutions and personal data on at least 68,000 people, naming Hana Bank, KB Kookmin Bank, and Shinhan Bank, with Shinhan at about 25,000 customers, plus 33 IP addresses linked to at least 12 countries and a 28-investigator team; an early Hacker News item only carried a hedged claim with no banks, models, or loss figures. CrowdStrike, cited from 8 October, described a late September to early October 2026 campaign by a suspected lone, financially motivated operator—moderate confidence Chinese-speaking, not tied to a known group—using ARTEX from developer Autumn-27 with DeepSeek v4.1-flash as the main model. Outlets disagree on whether GLM-5.3 and Grok 4.6 ran inside ARTEX or in separate Claude Code sessions, and on victim counts: Infosecurity Magazine added Yegaram Savings Bank at about 40,000 people, GBHackers limited KB Kookmin to 119 and rejected an unconfirmed nine-bank total for this operator, Cyber Security News listed further firms but said core banking was untouched, and BleepingComputer reported credit-card data exposure and some outages. Exposed logs indicated stolen data was being prepared for sale, including searches for Korean Telegram groups; Autumn-27 later shut or closed-sourced the project as unauthorized misuse, and possible operator identities in session files were not confirmed. The Financial Services Commission warned customers on 6 October about phishing and loan scams.