South Korea investigates signs of AI use in a series of attacks on banks

South Korean authorities are investigating a series of cyber incidents affecting banks and other financial institutions in the country. More than seven institutions reported customer data breaches during the past week, according to available reports. Police opened an investigation at the request of President Lee Jae Myung and, according to one report, formed a special team of 28 investigators.

The investigation aims to determine which systems were breached, what information was exposed, and who was behind the intrusions. For now, the figures and details vary among the institutions and reports, so they do not provide a single overall assessment of the scale of the incidents.

Evidence of artificial intelligence use is still inconclusive

Lee said there are signs that artificial intelligence was used in some of the attacks. The president warned that these tools could make certain tasks easier even for people without specialized knowledge. His remarks reflect an avenue of investigation and an official concern, but they do not confirm that AI was used in all the intrusions or explain how it may have been used.

A government official quoted by AFP considered it “very likely” that the attackers used Artex AI, described in that report as an open-source security testing tool. Authorities said that the possible use of the tool does not prove that those responsible were Chinese. Attribution and the specific role of any AI system remain to be determined.

The reported data differ from one institution to another

South Korea’s Financial Services Commission reported that more than 68,000 people had been affected by the attacks. That figure reflects the tally attributed to the agency and does not resolve the discrepancies among the data published for each bank.

Among the cases described, Shinhan Bank acknowledged the exposure of information relating to around 25,000 customers, while reports gave different figures for other incidents: one attributed data on 89 customers to Hana Bank, while another put the scope of the KB Kookmin case at 99 customers and 20 current or former employees. The types of data mentioned also vary. These reports do not warrant inferring that all the compromised information had the same scope or sensitivity.

One report said that, up to that point, financial authorities had found no evidence of leaked credentials that would enable unauthorized payments. That assessment does not rule out other risks and is not a definitive conclusion about all the incidents. The institutions and authorities will need to clarify what information was obtained and whether there was any further harm.

An investigation with an international dimension

Financial authorities have identified IP addresses detected in various countries. Their geographic distribution alone does not identify the attackers’ origin: connections may pass through intermediary servers or other infrastructure. The investigation will need to establish whether multiple actors are cooperating and, if so, coordinate with authorities in other jurisdictions.

For companies, the episode highlights the importance of distinguishing between a warning sign and a confirmed fact. In this case, data breaches or attempted intrusions at several institutions have been reported, and an official investigation is underway; by contrast, the specific use of AI, attribution, and the full extent of the damage remain unresolved. Lee called for the facts to be established and the damage contained, while authorities continue gathering information.