South Korea regulator urges AI-based defense after financial hacking wave
Version 2: New coverage names the open-source AI agent ARTEX as the suspected intrusion tool, reports inspection deadlines for about 500 financial companies, adds criticism of the regulator’s reliance on voluntary correction and notes a delay in selecting firms for network-separation exceptions.
In short
South Korea’s Financial Services Commission held an emergency meeting on 4 October after hacking and data leaks were confirmed at seven financial companies, including Shinhan, KB Kookmin, Hana and BNK Busan banks, savings banks Yegaram and Welcom, and Hyundai Capital. Chairman Lee Eok-won called for a system in which “AI fights AI”, warned of strict accountability for negligence and said external access should be blocked by default. The Financial Supervisory Service sent the attack IP, guidance and a 12-point checklist to about 500 financial companies, with banks and card firms to finish inspections by 6 October and other sectors by 8 October.
Read the full story 3 min read
South Korea’s Financial Services Commission held an emergency meeting on 4 October with the Financial Supervisory Service, industry associations and major financial companies to coordinate a response to a series of cyber intrusions. The meeting was chaired by FSC Chairman Lee Eok-won and attended by FSS Governor Lee Chan-jin and Financial Security Institute President Park Sang-won, along with the Ministry of Science and ICT, the Personal Information Protection Commission, police and the Korea Internet and Security Agency, according to Newsis and Seoul Economic Daily. Seoul Economic Daily said the meeting had originally been planned for 7 October and was moved forward after damage spread to smaller financial firms. [ 2 , 3 , 4 ]
Breach incidents were confirmed at seven companies: Shinhan, KB Kookmin, Hana and BNK Busan banks, savings banks Yegaram and Welcom, and Hyundai Capital. Authorities said the same attacker IP address was found at several companies, raising the possibility of large-scale automated attacks using AI tools, according to Newsis and ZDNet Korea. Lee said external web pages and servers used for convenience by loan brokers and employees had been used as attack targets, and cited weak authentication and excess stored data as blind spots. ZDNet Korea and Dong-A Ilbo reported that the suspected AI penetration tool ARTEX was linked to the attacks; Maeil Business said ARTEX was connected to Chinese DeepSeek and other large language models. [ 1 , 2 , 3 , 4 , 6 , 7 , 11 ]
The chairman warned that companies found negligent could face strict accountability under relevant laws and called for a system in which “AI fights AI”, saying new attack patterns exploiting unexpected vulnerabilities were spreading. He ordered financial companies to block all external access by default except where essential for services or operations, and to strengthen detection of abnormal transactions against secondary voice phishing and smishing. Seoul Economic Daily reported that no information usable for fraudulent payments had leaked yet. The FSS sent the attack IP, security guidance and a 12-point checklist to about 500 financial companies, with banks and card companies due to finish inspections by 6 October and securities, insurance, savings bank and electronic finance firms by 8 October, ZDNet Korea reported. [ 2 , 3 , 4 , 6 ]
Newsis reported criticism that the authorities had relied on verbal warnings and voluntary correction without a sufficient legal basis, allowing damage to spread. It said external contact points targeted in the attacks, such as Shinhan Bank’s loan recruiter lookup service, KB Kookmin’s employee mobile work system and Hana Bank’s sales support system, had been excluded from regular vulnerability assessments because companies decide which IT assets fall under the Electronic Financial Transactions Act. Maeil Business reported that an amendment to that law has been pending in the National Assembly for more than 10 months, and Chosun Ilbo reported that the FSC’s work to select additional companies eligible for network separation exceptions for AI security use has been delayed by the emergency response. [ 8 , 9 , 11 ]
The National Assembly’s science and ICT committee is due to question the Ministry of Science and ICT on 6 October about the response, with a committee official telling Newsis that a cybersecurity control tower spanning the National Intelligence Service, MSIT and KISA is seen as necessary. The committee also plans to question Tving CEO Choi Ju-hee over a separate breach in which a public-private investigation team said 39.54 million user accounts, including duplicates, were exposed. Separately, Newsis reported that global financial companies including HSBC and Mastercard are expanding AI-based defences and financial-crime detection. Kim Seung-joo, a Korea University professor, proposed eight measures in a Facebook post cited by ZDNet Korea, including identifying assets, cutting unnecessary attack surfaces, building an “AI responds to AI” system, applying zero trust and organising the measures under a Korean-style cybersecurity framework led by the National Security Office. [ 5 , 6 , 10 ]
Why it matters
The hacking wave puts customer data held by banks and smaller financial firms at the centre of public scrutiny and has prompted the regulator to order emergency inspections and consider wider use of AI for security despite network separation rules. New documents show criticism that authorities relied on voluntary correction and that legal gaps left external systems unchecked, while a parliamentary audit is due to question the government response. How the inspections and any rule changes unfold will shape how quickly Korean financial firms can field AI-based defences.
Key facts
- The FSC held an emergency meeting on 4 October chaired by Chairman Lee Eok-won with FSS Governor Lee Chan-jin and financial sector executives to respond to the hacking incidents. [ 2 , 3 , 4 , 8 ]
- Breach incidents were confirmed at seven companies: Shinhan, KB Kookmin, Hana and BNK Busan banks, Yegaram and Welcom savings banks, and Hyundai Capital. [ 1 , 4 , 6 ]
- Authorities said the same attacker IP was found at several companies, raising the possibility of large-scale automated attacks using AI tools. [ 4 , 6 ]
- Lee said external web pages and servers used by loan brokers and employees were used as attack targets and that one unmanaged gap could become a vulnerability. [ 2 , 3 ]
- Lee warned companies found negligent could face strict accountability under relevant laws and called for an “AI fights AI” security system. [ 2 , 3 , 4 ]
- The FSS sent the attack IP, security guidance and a 12-point checklist to about 500 financial companies; inspections were due by 6 October for banks and cards and by 8 October for other sectors. [ 6 ]
- The National Assembly’s science and ICT committee is due to question the Ministry of Science and ICT on 6 October about the response, and Tving CEO Choi Ju-hee is due to appear over a separate breach. [ 5 ]
- The FSC is pushing to expand exceptions to network separation rules so financial firms can use external high-performance AI for security, but a report says selection of additional firms has been delayed. [ 4 , 9 ]
Confirmed by several sources
- The Financial Services Commission held an emergency meeting on 4 October chaired by Chairman Lee Eok-won to respond to the hacking incidents. [ 2 , 3 , 4 , 8 ]
- Breach incidents affected Shinhan, KB Kookmin, Hana and BNK Busan banks, savings banks Yegaram and Welcom and Hyundai Capital. [ 1 , 4 , 6 ]
- Authorities said the same attacker IP was found at several affected companies. [ 4 , 6 ]
- Lee warned that companies found negligent could face strict accountability under relevant laws. [ 2 , 3 , 8 ]
- Lee called for a security system in which AI is used to defend against AI attacks. [ 1 , 2 , 3 , 4 ]
- Authorities said external web pages and servers used by loan brokers and employees were used as attack targets. [ 2 , 3 , 8 ]
- The government is pushing to ease network separation rules for security use of AI. [ 2 , 4 , 9 ]
Still unclear
- Who carried out the attacks No document names an attacker, their location or an affiliation; outlets describe the incidents only as external cyberattacks.
- Whether AI was actually used in the attacks Documents describe suspected AI tools or the possibility of AI-based automated attacks, not official confirmation.
- The scale of leaked data at each affected company Only one document gives a figure, reporting 25,000 affected people at Shinhan Bank; other outlets give no figures.
- The role of the open-source AI agent ARTEX A tech outlet calls it an open-source AI agent, another calls it an AI penetration tool and a business outlet links it to Chinese DeepSeek and other large language models; no official document confirms these details.
- The outcome of the inspections and whether deadlines will be met Documents give deadlines and checklist items but no results.
- Whether network separation exceptions will be expanded or delayed One document says the FSC is pushing expansion, while another says selection of additional companies has been delayed by the emergency response.
What local media are saying
Timeline, local time
- The FSC and FSS hold an emergency meeting on cyber intrusion threats at the Government Complex in Seoul, chaired by Chairman Lee Eok-won; the meeting was moved forward from 7 October. [ 3 ]
- Newsis reports Lee’s call for AI-based security to be prepared quickly. [ 1 ]
- Newsis reports the meeting, attendees and Lee’s warning of strict accountability. [ 2 ]
- Seoul Economic Daily reports the meeting, five directives and that no data usable for fraudulent payments has leaked yet. [ 3 ]
- Newsis reports the FSC’s plan to expand network separation exceptions for security AI and the shared attacker IP. [ 4 ]
- Newsis reports the National Assembly science and ICT committee will take up the AI hacking response. [ 5 ]
- ZDNet Korea reports FSS guidance to about 500 financial companies and inspection deadlines. [ 6 ]
- Banks and card companies are to complete emergency inspections by 6 October, the day the science and ICT committee questions the Ministry of Science and ICT. [ 5 , 6 ]
- Dong-A Ilbo reports that the suspected AI penetration tool ARTEX directed intrusions at seven financial companies and cites KISA intrusion statistics. [ 7 ]
- Newsis reports criticism that the authorities relied on verbal warnings and voluntary correction as hacking spread. [ 8 ]
- Chosun Ilbo reports the schedule to expand financial companies’ AI security tool use has been delayed by the response and emergency inspections. [ 9 ]
- Newsis reports global financial companies are expanding AI-based defence and financial-crime detection. [ 10 ]
- Maeil Business reports authorities have warned since 2018 about external connected networks and that an Electronic Financial Transactions Act amendment has been pending for over 10 months. [ 11 ]
- Securities, insurance, savings bank and electronic finance firms are to complete inspections by 8 October. [ 6 ]