South Korea is confronting a new cybersecurity challenge after reported breaches involving seven financial institutions exposed sensitive personal information belonging to more than 60,000 customers. Investigators are examining whether artificial intelligence helped attackers identify vulnerabilities and accelerate their operations.
The affected institutions reportedly include Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital. Shinhan reported approximately 25,700 affected customers, while Yegaram disclosed around 40,000.
Attackers also reportedly targeted Woori Bank and NH NongHyup Bank, although no confirmed data losses have emerged from those attempted intrusions.
The compromised information reportedly includes customer names, contact details, resident registration numbers, annual income and loan limits. Such records could enable identity theft, financial impersonation, targeted phishing and sophisticated banking fraud.
The investigation has uncovered possible links to Artex AI, a Chinese-language, open-source penetration-testing tool available on GitHub. The software reportedly uses artificial intelligence to automate vulnerability discovery and assist security testing.
South Korea's cyber investigators reportedly reconstructed attack activity using server logs, IP addresses and technical signatures resembling those associated with Artex AI. However, authorities have not conclusively established whether the tool directly executed the breaches.
President Lee Jae Myung has reportedly ordered a comprehensive investigation amid concerns that AI agents may have participated in certain attacks.
The incidents illustrate a significant cybersecurity shift. Tools originally designed for ethical penetration testing can potentially be misused to automate reconnaissance, accelerate exploitation and reduce the technical expertise required by attackers.
For Indian banks, the implications are serious. AI-assisted attacks demand continuous vulnerability assessment, behavioural monitoring, stronger identity verification, data protection and rapid incident response.
The emerging security principle is clear: AI-powered banking infrastructure must be protected by equally adaptive, continuously verified cybersecurity systems.
