South Korea’s president said there were signs that AI models had been used in cyber attacks on banks, as concern mounted over a flood of incidents in the past week.
At a cabinet meeting on Tuesday, Lee Jae Myung said hacks had exposed user data at seven financial firms, with evidence of AI use in some “causing considerable public concern and anxiety”.
The hackers appear to have targeted less secure systems used by third parties, rather than the banks’ core payment networks. In one case, an attacker bypassed identity checks on a portal where loan brokers tracked customers’ applications, exposing the details of about 25,000 Shinhan Bank customers.
Police have opened a full investigation into the attacks, according to the Yonhap news agency.
No funds have been reported stolen, but one official with knowledge of the situation said: “It feels like a completely new kind of crisis. Generative AI was used to identify vulnerabilities and launch an attack. It’s not that South Korea has weak cyber security — this sort of thing could happen anywhere.”
Last Friday, Moon Jong-hyun, head of Genians Security Center, said evidence suggested that Artex — a Chinese-language, open-source tool that uses AI to find and test computer system vulnerabilities — had been used in some of the attacks.
In a LinkedIn post, he compared Artex to a kitchen knife that could either be used by a chef or wielded “as a weapon by a criminal”.
In addition to the Shinhan case, about 40,000 customers at Yegaram Savings Bank and 2,200 corporate clients at Welcome Savings Bank had data exposed.
Smaller breaches affected KB Kookmin Bank and Hana Bank, while BNK Busan Bank and Hyundai Capital reported leaks involving contractors or loan brokers. The use of identical or similar IP addresses suggests a single attacker may have been behind at least some of the attacks.
At an emergency meeting on Sunday, Financial Services Commission chair Lee Eog-weon called for “the highest level of vigilance” and said the financial sector should build systems that “defend against AI attacks with AI”.
The science ministry and its cyber security agency have mounted a 24-hour emergency response and asked cloud providers to block activity from suspect overseas IP addresses.
Last year Anthropic said suspected Chinese state-backed hackers used Claude code to target about 30 organisations worldwide, including financial institutions. In February this year, fraudsters used AI-powered impersonation to trick Italian private bank Fideuram out of €95mn.
The recent wave of suspected AI-assisted attacks may intensify scrutiny of cyber security in South Korea, already a sensitive issue following a series of major breaches.
Over the past year, incidents at ecommerce company Coupang and streaming service TVing affected millions of customer accounts, while financing platform LotteCard and communications group KT also suffered security failures.