Data Breaches at South Korean Banks Linked to AI Attacks

In late September and early October 2026, at least seven financial institutions in South Korea, including Shinhan Bank, Kookmin Bank, and Hana Bank, reported significant data breaches. Approximately 25,000 customers of Shinhan Bank and around 40,000 customers of Yegaram Savings Bank were impacted, with leaked information comprising names, phone numbers, annual income, and loan limits. So far, there has been no evidence of stolen funds, but the breaches have raised serious concerns about the security of banking systems.

The attacks primarily targeted loan inquiry services utilized by loan intermediaries and peripheral banking systems, including employee mobile office systems. South Korean regulatory authorities have indicated that the attacks may have been executed by the same perpetrator due to overlapping IP addresses. On October 6, South Korean President Yoon Suk-yeol suggested that artificial intelligence may have played a role in these cyberattacks.

On October 7, cybersecurity firm CrowdStrike reported that the attackers operated from a server located in Hong Kong, employing an open-source AI penetration testing system known as ARTEX. Investigators discovered configuration files and chat records linked to the attackers, revealing their use of AI tools such as Claude Code and DeepSeek v4.1-flash. The chat logs included discussions about selling the leaked data in South Korea and drafting a resume for a fictitious security researcher, raising suspicions about the attackers' identities and motives. CrowdStrike assessed that the attackers might be based in China and were likely motivated by financial gain, although their true identities remain unverified.

© 2026 KLEA News. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Source: KLEA News