South Korea's President Warned AI Was Used to Hack 7 Banks, Exposing 68,000 People

 

South Korea's President Warned AI Was Used to Hack 7 Banks, Exposing 68,000 People

## The Cyberattack That Just Changed Everything About Digital Security

Let me tell you about a moment that should make every American bank customer, business owner, and technology executive sit up and pay attention.

**On September 30, 2026, South Korea's financial sector was hit by a cyberattack unlike anything we've seen before.**

Within days, the scope became clear: **At least seven financial institutions were breached. Over 68,000 people had their personal information exposed** . And the weapon of choice wasn't a human hacker sitting at a keyboard. It was **artificial intelligence** .

**Shinhan Bank** reported that personal data from approximately **25,000 customers**—including names, phone numbers, and annual income—had been leaked . **KB Kookmin Bank** followed with its own disclosure . **Hana Bank**, **BNK Busan Bank**, **Yegaram Savings Bank**, **Welcome Savings Bank**, and **Hyundai Capital** were all hit .

**President Lee Jae Myung** addressed the nation on Tuesday, October 6, and his words were chilling: **"Signs have emerged that artificial intelligence was used in some hacking attacks, causing considerable concern and anxiety among the public"** .

Then he delivered the line that should terrify every security professional on Earth: **"We have now reached a point where AI can make hacking easy for even those without special skills"** .

---

## What Actually Happened: The Anatomy of an AI-Powered Attack

### The Tool That Did the Work

**Frequently Asked Question:** *What specific AI tool was used in these attacks?*

According to multiple reports, investigators have found traces of **Artex AI**—an open-source security testing tool believed to be a Chinese AI system .

**But here's the critical nuance that officials have emphasized:** The use of a Chinese-developed tool **does not mean the attackers were Chinese** .

**Park Sang-won**, head of South Korea's Financial Security Institute, explained why: **"Attackers can move between and use IP addresses in multiple locations, so it is impossible to identify an attacker based on an IP address alone"** .

**Frequently Asked Question:** *How does an AI agent actually hack a bank?*

This is the part that represents a fundamental shift in cybersecurity.

Traditional hacking requires a human to:

- Manually scan for vulnerabilities

- Write or adapt exploit code

- Navigate complex systems

- Cover their tracks

**An AI agent does all of this autonomously.**

**Artex AI** is designed to **identify network vulnerabilities and autonomously draw up a hacking route** . It's essentially a **self-directed penetration testing tool**—except in this case, it was used for actual penetration, not testing.

**The New York Times noted** that the ability of AI systems to find previously unknown software vulnerabilities is now **"in the global spotlight as leading labs release ever-more advanced models"** .

### The Scope of the Breach

**Frequently Asked Question:** *How many people were actually affected?*

The numbers grew as the investigation expanded.

**Initial reports:** More than **60,000 people** across seven financial firms .

**Updated figures:** **68,000+ people** confirmed by the Financial Services Commission .

**The breakdown by institution:**

- **Yegaram Savings Bank:** ~40,000 customers affected—the hardest hit 

- **Shinhan Bank:** ~25,000 customers 

- **KB Kookmin Bank:** 99 customers and 20 employees 

- **Hana Bank:** 89 customers 

- **Welcome Savings Bank:** 2,299 confirmed cases 

**The data leaked included:** Names, dates of birth, phone numbers, and—in some cases—**annual income and loan application information** .

**Frequently Asked Question:** *Why does it matter that income data was leaked?*

Because it makes victims **prime targets for financial fraud and social engineering attacks**.

**Hwang Seong-ho**, head of NordVPN's South Korean branch, warned that leaked personal information from previous breaches could be **combined with the newly stolen financial data** to enable **fraud or other criminal activities** .

---

## The Government Response: "AI to Fight AI"

### President Lee's Directive

**Frequently Asked Question:** *What did the South Korean government do?*

**President Lee didn't wait.**

On Tuesday, October 6, he convened a Cabinet meeting and issued a direct order: **"Please carry out a swift and clear determination of the circumstances and concentrate personnel and resources on minimizing damage"** .

**He also called for a fundamental shift in approach:** **"It is difficult to respond to evolving cyber threats by handling accidents after they happen. We must have the security capabilities to detect and block attacks in advance"** .

**And he specifically emphasized:** **"We must accelerate efforts to develop and adopt AI tools tailored for cyber security"** .

**Translation:** South Korea is now officially pursuing an **"AI vs. AI"** defense strategy.

### The Investigation

**Frequently Asked Question:** *Has anyone been caught?*

**Not yet.** But the investigation is moving fast.

**The National Office of Investigation** has assembled a **28-member team** to investigate the attacks, focusing on **violations of the information and communications network law** .

**The Financial Services Commission** held an **emergency meeting** with financial industry associations and the CEOs of affected institutions on **October 4**—**three days earlier than originally scheduled**—because the scope of the breaches kept expanding .

**Investigators have identified:**

- **19 to 33 IP addresses** across **12 countries** linked to the attacks 

- Traces of the **Artex AI tool** on a server used in the attacks 

- Evidence that **the same attacker group** may be behind multiple breaches 

**Frequently Asked Question:** *Was North Korea involved?*

**South Korea's main opposition party, the People Power Party, has called for an investigation into possible North Korean involvement**, citing past cyberattacks on South Korean financial institutions attributed to Pyongyang .

**No evidence has been presented publicly linking North Korea to these specific attacks.**

---

## The Human Cost: 68,000 People Whose Lives Just Changed

### The Anxiety Is Real

**Frequently Asked Question:** *What does this mean for the people affected?*

**It means their personal information is out there.** Names. Birthdays. Phone numbers. In some cases, income and loan data.

**It means they're vulnerable to:**

- **Phishing attacks** targeting their specific information

- **Identity theft**

- **Financial fraud**

- **Social engineering** that uses real data to build trust

**It means anxiety.** The kind that doesn't go away when the news cycle moves on.

**The Korea Herald reported** that some customers have **already organized groups to prepare class-action lawsuits** seeking compensation for the data leaks .

### The Institutional Failure

**Frequently Asked Question:** *Did the banks have adequate security?*

**The evidence suggests they didn't.**

**Shinhan Bank was attacked via its loan application service**, where unauthorized access **bypassed identity verification** .

**KB Kookmin Bank's breach** occurred through an **employee mobile work support system** .

**Welcome Savings Bank was hacked for approximately 120 hours**—**five full days**—before the breach was detected .

**The Financial Services Commission acknowledged** that the attacks **may have broadly sought vulnerabilities across multiple financial companies** rather than targeting a single institution .

**In other words:** The entire financial sector was exposed, and the attackers found the weak points.

---

## Frequently Asked Questions

**Q: What exactly happened in South Korea?**

A: At least **seven financial institutions** were hacked, exposing personal data of **68,000+ people**. President Lee Jae Myung said **AI was likely used** in the attacks .

**Q: Which banks were affected?**

A: **Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank, and Hyundai Capital** .

**Q: What data was leaked?**

A: Names, dates of birth, phone numbers, and in some cases **annual income and loan application details** .

**Q: What AI tool was used?**

A: Investigators found traces of **Artex AI**, an open-source security testing tool believed to be Chinese. But officials emphasized this **doesn't mean the attackers were Chinese** .

**Q: How does AI make hacking different?**

A: AI agents can **autonomously identify vulnerabilities, plan attack routes, and execute intrusions** without human direction. They lower the skill barrier and increase scale .

**Q: What is South Korea doing about it?**

A: President Lee ordered a **swift investigation**, a **28-member police task force**, and a shift toward **"AI vs. AI"** cybersecurity defenses .

**Q: Has anyone been arrested?**

A: **Not yet.** Investigators are tracking **IP addresses in 12 countries** .

**Q: Are class-action lawsuits happening?**

A: **Yes.** Customer groups are forming to prepare class-action suits for compensation .

**Q: Why should Americans care?**

A: Because the **same AI tools can be used against U.S. banks**. This is a **global cybersecurity wake-up call**, not just a South Korean problem.

---

## Conclusion: The Warning America Can't Ignore

Let me bring this home.

**What happened in South Korea isn't just a South Korean story.**

It's a **preview of what's coming for every financial system on Earth.**

**The attackers used AI to find vulnerabilities, plan routes, and execute breaches autonomously.** They hit seven institutions in rapid succession. They exposed 68,000 people. And they **haven't been caught**.

**President Lee's words should echo in every boardroom and government office:** **"We have now reached a point where AI can make hacking easy for even those without special skills"** .

**That's the new reality.**

For decades, cybersecurity was a game of cat and mouse between skilled humans. The good guys built walls. The bad guys found cracks. It was slow, manual, and required expertise.

**AI changes everything.** It automates the search for cracks. It scales the attacks. It lowers the barrier to entry. And it does all of this **faster than humans can respond**.

**South Korea is responding with "AI to fight AI"** . That's the right instinct. But it's a **reactive** strategy. The attack already happened. The data is already out there. The 68,000 victims already have to live with the consequences.

**The real question is:** What are **American** banks doing to prepare?

**Because if it can happen to Shinhan, KB Kookmin, and Hana, it can happen to JPMorgan, Bank of America, and Wells Fargo.**

**The AI hacking era isn't coming. It's here. And South Korea just showed us what it looks like.**

---

## Disclaimer

**This article is for informational purposes only and does not constitute financial, cybersecurity, or legal advice.**

I am not a licensed cybersecurity professional, financial advisor, or legal expert. The views expressed here are based on publicly available information and my own analysis at the time of writing.

**Key facts cited in this article are sourced from Yonhap News Agency, NHK, The New York Times, The Record, RTHK, SWI swissinfo.ch, AFP, and other outlets as of October 6-7, 2026.** The investigation is ongoing. Details about the attackers, the tools used, and the full scope of the breach may change as more information emerges.

**No definitive conclusion has been reached about who was behind the attacks or whether AI was definitively used in all cases.** The use of a Chinese-developed tool does not indicate Chinese involvement, as officials have emphasized. The investigation is continuing.

**Cybersecurity decisions should be made in consultation with qualified professionals.** This article describes a specific incident and its implications. It does not provide guidance on how to protect your personal information or systems. If you have concerns about your own data security, consult a qualified cybersecurity professional.

**Always conduct your own research before making any financial or security decisions.** Do not make decisions based solely on news articles or opinion pieces.