Korea police open formal probe into AI-linked hacking of financial firms
Version 3: Police opened a formal investigation with a 28-member team, the confirmed breach tally rose to seven financial companies with nearly 70,000 records reported leaked, additional victims including Welcom Savings Bank and P2P lenders were identified, and President Lee Jae-myung ordered a thorough probe.
In short
South Korean police have converted their investigation into a series of AI-linked hacking attacks on financial institutions into a formal probe, assigning a 28-member, four-team dedicated unit. Data leaks have been confirmed at seven financial companies — Shinhan, KB Kookmin, Hana, BNK Busan, Egaram Savings Bank, Welcom Savings Bank and Hyundai Capital — with nearly 70,000 records reported leaked. The Financial Services Commission held an emergency meeting on October 4, and authorities suspect the attacks used automated AI tools including the Chinese-developed ARTEX.
Read the full story 3 min read
South Korean police said on 6 October that they had converted their investigation into the recent hacking of financial institutions into a formal probe and booked the case as a violation of the Information and Communications Network Act, according to Yonhap, Seoul Economic Daily, Chosun Ilbo and Dong-A Ilbo. The National Office of Investigation designated the Korean National Police Agency's cyberterror investigation unit as the dedicated team, comprising four teams and 28 people, with Lee Dong-hoon, head of the cyberterror response division, as its leader, Seoul Economic Daily reported. Police are also reviewing whether the case should be notified to the newly launched Serious Crime Investigation Agency, and have asked the Financial Services Commission to interpret whether the breached systems qualify as electronic financial infrastructure, according to Seoul Economic Daily and Dong-A Ilbo. [ 24 , 28 , 34 , 39 , 40 ]
Data leaks have been confirmed at seven financial companies: Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Egaram Savings Bank, Welcom Savings Bank and Hyundai Capital, according to Dong-A Ilbo, Newsis and CBS NoCut News. Dong-A Ilbo reported that nearly 70,000 personal records were leaked across the companies. Shinhan Bank had about 25,000 to 25,727 customers' information exposed, including names, phone numbers, annual income and loan limits, according to Newsis and Kyunghyang Shinmun. KB Kookmin Bank reported 119 customers' information leaked, Hana Bank 89, and BNK Busan Bank 11 outsourced developers, according to Newsis. Egaram Savings Bank lost information on about 40,000 customers, Hyundai Capital 146 loan recruiters, and Welcom Savings Bank about 2,200 corporate customer records, according to Hankook Ilbo, Kyunghyang Shinmun and Dong-A Ilbo. Kyunghyang Shinmun and Newsis also reported leaks at two online investment-linked finance companies. [ 2 , 6 , 8 , 9 , 15 , 18 , 19 , 23 , 26 ]
The attacks are suspected to have used AI-based automated tools. Kyunghyang Shinmun reported that traces of a Chinese-language AI penetration-testing tool called ARTEX were found, a tool first published on GitHub on 26 July, with its latest version released on 24 September, three days before the KB Kookmin Bank attack began. The Financial Security Institute chief, Park Sang-won, said attack IPs were nearly identical for banks and somewhat different for savings banks, with similar methods, but that the attacker's nationality could not be concluded from the use of a Chinese tool, according to Kyunghyang Shinmun. Maeil Business and Dong-A Ilbo reported that the attackers targeted relatively weakly protected peripheral systems, such as loan recruiter services and employee work-support systems, rather than core banking channels. [ 9 , 12 , 13 , 15 , 16 , 23 ]
The Financial Services Commission held an emergency inspection meeting at 2 p.m. on 4 October at the Government Complex Seoul, chaired by FSC Chairman Lee Eok-won, according to Asia Economy, Hankook Ilbo, Dong-A Ilbo and CBS NoCut News. Association heads for all financial sectors and the chief executives of companies hit by breaches were summoned. The meeting was moved up from an original plan to receive the results of companies' own security checks on 7 October. Hankook Ilbo reported that Financial Supervisory Service Governor Lee Chan-jin attended. Authorities distributed attacker IPs and security guidance to about 500 financial companies and ordered banks and card firms to complete checks by 6 October and insurance, securities, savings banks and electronic finance firms by 8 October, according to Newsis. [ 1 , 2 , 5 , 6 , 9 , 12 , 18 ]
Several institutions said they blocked the attacks. Woori Bank, NH Nonghyup Bank and Saemaul Geumgo Central Federation were attacked but no data leaks have been confirmed, according to Kyunghyang Shinmun, Newsis and a Chosun Ilbo editorial. Maeil Business reported that Woori Financial Group used a Claude-based cybersecurity solution called Jint to conduct round-the-clock mock hacking. CBS NoCut News, citing an opposition lawmaker's office, reported that Toss Bank blocked 14 attack attempts from some of the same IPs since early this year. Insurance, card and securities firms and industrial sectors including electronics, autos, construction, aviation and steel have also conducted emergency checks, according to Newsis and Yonhap. [ 9 , 12 , 18 , 20 , 21 , 22 , 23 , 25 , 26 ]
Consumer anxiety has grown. Newsis reported that community posts questioned whether bank deposits and personal data were safe, but that no attacks on core banking systems or fraudulent payments had been identified. Shinhan Bank said it had completed text messages and notices to all affected customers and would announce compensation and further measures after consulting authorities, according to Kyunghyang Shinmun. [ 9 , 19 ]
Why it matters
The breaches affected customer data at major banks, savings banks and a capital firm, and the scale of the leaks could grow as authorities complete inspections of about 500 financial companies. The suspected use of automated AI attack tools and traces of a publicly released Chinese penetration-testing tool raise questions about whether financial firms' peripheral systems can withstand automated attacks. The police investigation and sector-wide checks may lead to tighter security rules and liability measures.
Key facts
- Police converted the investigation into a formal probe and designated a 28-member, four-team dedicated unit. [ 24 , 27 , 28 , 29 , 30 , 31 , 32 , 33 , 34 , 35 , 36 , 37 , 38 , 39 , 40 ]
- The case was booked as a violation of the Information and Communications Network Act. [ 34 , 39 , 40 ]
- The Financial Services Commission held an emergency inspection meeting at 2 p.m. on 4 October at the Government Complex Seoul, chaired by FSC Chairman Lee Eok-won. [ 1 , 2 , 5 , 6 , 9 , 12 ]
- Leaks were confirmed at Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Egaram Savings Bank, Welcom Savings Bank and Hyundai Capital. [ 15 , 18 , 19 , 23 , 26 , 36 ]
- Shinhan Bank had about 25,000 to 25,727 customers' information exposed; KB Kookmin Bank reported 119 customers, Hana Bank 89, and BNK Busan Bank 11 outsourced developers. [ 8 , 9 , 19 , 23 ]
- Egaram Savings Bank lost information on about 40,000 customers, Hyundai Capital 146 loan recruiters, and Welcom Savings Bank about 2,200 corporate customer records. [ 2 , 6 , 9 , 15 , 18 , 19 ]
- Investigators found traces of the Chinese-developed AI penetration-testing tool ARTEX, and suspect the attacks used automated AI tools. [ 9 , 12 , 14 , 15 , 16 , 23 ]
- Woori Bank, NH Nonghyup Bank and Saemaul Geumgo Central Federation were attacked but no data leaks were confirmed. [ 9 , 12 , 23 , 25 ]
Confirmed by several sources
- Police converted the investigation into a formal probe and designated a 28-member, four-team dedicated unit. [ 24 , 27 , 28 , 29 , 30 , 31 , 32 , 33 , 34 , 35 , 36 , 37 , 38 , 39 , 40 ]
- Police booked the case as a violation of the Information and Communications Network Act and are reviewing whether to notify the Serious Crime Investigation Agency. [ 34 , 39 , 40 ]
- The Financial Services Commission held an emergency inspection meeting at 2 p.m. on 4 October at the Government Complex Seoul, chaired by FSC Chairman Lee Eok-won. [ 1 , 2 , 5 , 6 , 9 , 12 ]
- The meeting was moved up from an original plan under which companies would run their own checks and report results on 7 October. [ 1 , 2 , 5 , 6 ]
- Leaks were confirmed at Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Egaram Savings Bank, Welcom Savings Bank and Hyundai Capital. [ 15 , 18 , 19 , 23 , 26 , 36 ]
- Shinhan Bank had about 25,000 customers' information exposed; KB Kookmin Bank reported 119 customers, Hana Bank 89, and BNK Busan Bank 11 outsourced developers. [ 8 , 9 , 19 , 23 ]
- Egaram Savings Bank lost information on about 40,000 customers, Hyundai Capital 146 loan recruiters, and Welcom Savings Bank about 2,200 corporate customer records. [ 2 , 6 , 9 , 15 , 18 , 19 ]
- Investigators found traces of the Chinese-developed ARTEX AI tool and suspect automated AI-based attacks. [ 9 , 12 , 14 , 15 , 16 , 23 ]
- Woori Bank, NH Nonghyup Bank and Saemaul Geumgo Central Federation were attacked but no data leaks were confirmed. [ 9 , 12 , 23 , 25 ]
Still unclear
- Whether all the breaches were carried out by the same actor. Asia Economy reported it was unclear; Kyunghyang Shinmun quoted the Financial Security Institute chief saying attack IPs were nearly identical for banks and somewhat different for savings banks, with similar methods; no official confirmation.
- President Lee Jae-myung ordered a thorough investigation. Reported only by Dong-A Ilbo.
- The total number of leaked records is nearly 70,000. Stated only by Dong-A Ilbo; other documents give individual figures that vary slightly, such as Shinhan Bank at 25,000 or 25,727.
- Financial Supervisory Service Governor Lee Chan-jin attended the emergency meeting. Reported only by Hankook Ilbo.
- Whether the attacked systems qualify as electronic financial infrastructure, which would require notification to the Serious Crime Investigation Agency. Police have requested an interpretation from the Financial Services Commission, according to Seoul Economic Daily and Dong-A Ilbo.
- Toss Bank blocked 14 attack attempts from some of the same IPs since early this year. Reported only by CBS NoCut News, citing an opposition lawmaker's office.
- Authorities distributed attacker IPs and guidance to about 500 financial companies, ordering banks and card firms to complete checks by 6 October and others by 8 October. Reported only by Newsis.
What local media are saying
Timeline, local time
- KB Kookmin Bank's system was attacked; the breach lasted until 29 September and was recognized on 30 September, according to CBS NoCut News. [ 26 ]
- Attack on Shinhan Bank's M Shinhan mobile services began and was recognized the next morning, according to CBS NoCut News. [ 26 ]
- Egaram Savings Bank was hacked, leading to the leak of about 40,000 customers' information, according to Dong-A Ilbo. [ 15 ]
- Asia Economy reported that financial authorities would convene all financial sector association heads and breached companies' chief executives the following day. [ 1 ]
- The Financial Services Commission held an emergency inspection meeting at the Government Complex Seoul, chaired by FSC Chairman Lee Eok-won. [ 1 , 2 , 5 , 6 ]
- Newsis reported that insurance and card sectors were checking for similar damage and that authorities had set check deadlines. [ 18 ]
- Yonhap reported that industrial sectors including electronics, autos, construction, aviation and steel had begun emergency checks. [ 20 ]
- Kukmin Ilbo reported that police had converted the hacking investigation into a formal probe with a 28-member team. [ 24 ]
- Yonhap reported that the police had launched a formal investigation into the AI hacking of banks. [ 28 ]
- Seoul Economic Daily reported details of the formal investigation, including the booking under the Information and Communications Network Act and the review of notification to the Serious Crime Investigation Agency. [ 34 ]