Police investigate suspected AI-assisted attacks on South Korean banks

The National Police Agency began a preliminary investigation into suspected AI hacking attacks targeting major domestic banks.[2] Police suspect an automated method repeatedly exploited vulnerabilities in systems used by bank employees or in sales-support systems.[2] The banks confirmed as having suffered hacking damage are Shinhan, KB Kookmin, Hana and BNK Busan.[2] Woori Bank and NH Nonghyup reported suspected attempts but said no personal-information leak had been confirmed.[1] The reports therefore distinguish between confirmed damage and suspected attempts, rather than establishing that every institution had the same outcome.[2][1]

Shinhan reported a leak involving about 25,000 customers; the exposed information included names, phone numbers, annual income and loan limits.[3][1] An unauthorized outsider bypassed identity verification in Shinhan’s loan-recruiter service.[4] KB said information belonging to 119 customers leaked from an employee mobile work-support system, including names, phone numbers, addresses and encrypted resident registration numbers.[5] Hana reported 89 affected customers and said the exposed information may have included names and contact details, addresses, employer names and resident registration numbers.[5]

KB said its incident was unrelated to customers’ internet and mobile banking transactions, and that it would fully compensate customers for any losses.[5] The bank said it blocked the affected server and access route after detecting possible leakage through abnormal external access on the night of September 30.[5] Hana said its operations-support system is separate from its internet and mobile banking transaction systems, and that customer financial transaction information was not compromised.[1] Hana said it would fully compensate customers if actual damage occurred.[5] Shinhan said it formed a response team, blocked external IP addresses and suspended affected services.[3]

Investigators found a Chinese-language phrase meaning “AI autonomous penetration” in web-server page titles thought to be linked to the Shinhan attack.[2] Authorities and Shinhan had not confirmed whether ARTEX AI was used.[4] ARTEX AI is an open-source, Chinese-language large-language-model-based autonomous penetration-testing system designed to automate information gathering, vulnerability discovery, attack-path planning, security-tool execution and vulnerability verification.[4] Threat analysts said AI-based attack-automation tools may have been used in attacks on financial companies, and attackers could misuse such tools to increase the automation and efficiency of attacks.[4]