South Korea Investigates Possible Use of A.I. in Hackings on Its Banks

South Korean authorities have launched a full-scale investigation into cyberattacks targeting major domestic banks, with top officials warning that artificial intelligence may have been utilized to bypass traditional technical barriers. NBC News and other outlets reported that the National Office of Investigation is leading the probe following breaches across several national financial institutions.

What happened during the bank breaches?

Shinhan Bank, KB Kookmin Bank, Hana Bank, and Woori Bank all reported cyberattacks and varying scopes of compromised data. Shinhan Bank reported leaked personal credit information belonging to about 25,000 individuals, according to NBC News, Tom's Hardware, and The Business Times. KB Kookmin Bank reported cyberattacks affecting 99 customers and 20 current or former employees, alongside leaked credit card information for 119 clients, as reported by BleepingComputer and other outlets. Hana Bank suffered a limited-scope breach affecting 89 customers after its sales-support system was compromised. Woori Bank also suffered breaches, which were reported by Yonhap.

What have South Korean officials said about AI involvement?

During a Cabinet meeting on Tuesday, October 6, 2026, South Korean President Lee Jae Myung stated that in some hacking incidents, signs have emerged of AI being used, causing considerable public concern and anxiety. President Lee asked officials to establish the circumstances swiftly and clearly, concentrate personnel and resources on minimizing the damage, and noted that it has become possible to use AI to hack with ease even without specialized skills.

Financial Services Commission Chairman Lee Eog-weon convened an emergency meeting warning that the sector must respond with the highest level of vigilance. Chairman Lee stated that authorities cannot rule out the possibility of hacking attacks utilizing AI, adding that the country must hurry to establish a security system where AI attacks are defended by AI. South Korean Prime Minister Han Duck-soo also stated the situation is serious because the incident is believed to have taken advantage of artificial intelligence, warning that AI-driven phishing attacks could lead to secondary damage.

Who is suspected of carrying out the attacks?

South Korean authorities have not yet publicly disclosed what specific AI tools were used or the full scale of the breaches. However, CrowdStrike reported a suspected 26-year-old China-based individual as a possible hacker, utilizing a Chinese-developed AI agent alongside Anthropic’s Claude Code and an open-source agentic penetration-testing framework called ARTEX or ARTEX AI, according to Tom's Hardware and BleepingComputer.

Despite these reports, South Korean police stated they had no comment on the CrowdStrike assessment while investigations remain underway, and financial authorities have not confirmed ARTEX AI's use. Anthropic has not issued a public statement confirming the misuse of Claude Code in this campaign.

What are regulators doing in response?

Financial regulators have instructed institutions to inspect externally accessible IT systems, reduce unnecessary information exposure, check access controls, share threat information quickly, and submit internal security inspection results. The Financial Supervisory Service also shared data on 28 unique IP addresses related to the incidents to aid defensive measures.