Five days, seven firms
Seven South Korean financial companies have reported customer data leaks since Thursday, and investigators believe one attacker ran all of them with the help of an autonomous AI penetration-testing tool. The Korea Times put the number of people affected at more than 67,000. The same attacker IP address was found at all seven firms.
The Korea Herald listed the breaches as Shinhan Bank, with loan application records on about 25,000 people; Yegaram Savings Bank, with about 40,000; Welcome Savings Bank, with 2,200 cases; Hyundai Capital, 146 individuals; KB Kookmin Bank, 153; Hana Bank, 89 cases; and BNK Busan Bank, 11 outsourced workers. Woori Bank and NH NongHyup Bank said intrusion attempts against them were blocked. The exposed records include names, contact details, resident registration numbers, annual income and borrowing limits.
What investigators found on the server
The tool investigators point to is Artex, a Chinese-language open-source penetration-testing system distributed through GitHub. It uses a large language model to run reconnaissance, find vulnerable login endpoints, plan a route in, execute the attack and verify the result, without a human directing each step. Analysts at the Korea Financial Security Institute identified it from a signature its traffic leaves behind, and traces of it were found on a server believed to have been used in the attacks.
Two qualifications matter. Investigators say a human directed the campaign; the tool automates the work, it did not choose the targets. And the Chinese-language interface says nothing about where the operator is. The Financial Services Commission has not confirmed that Artex was used, and its chairman, Lee Eok-won, put it carefully: “We cannot rule out the possibility of attacks using AI.”
The regulator’s response
The commission convened an emergency meeting with financial industry leaders on Sunday and ordered firms to block external access to their systems unless it is essential to the business. The Financial Supervisory Service told companies to complete emergency security inspections by Thursday. President Lee Jae Myung instructed authorities to investigate thoroughly, his spokesperson Kang Yu-jung said.
Lee Eok-won said there is currently no indication that sensitive information has been leaked, but that secondary damage such as voice phishing cannot be ruled out. “We need to check the entire security framework to ensure there are no gaps,” he said.
Money spent in the wrong places
The uncomfortable part for the banks is that none of this got through the front door. The Korea Herald reported 2026 security spending of 86.07 billion won at KB Kookmin, 63.63 billion at Hana, 61.56 billion at Woori and 40.59 billion at Shinhan. The attacks went instead through employee systems, contractor access and loan agent networks — the edges of the perimeter rather than the core.
That asymmetry is the point several Korean academics made this week. Lim Jong-in, a professor who has advised the government on security, said AI agents are “capable of automatically searching for vulnerabilities”. Hwang Suk-jin put the problem on the defending side: “As attacks are becoming more coordinated and automated, defenses cannot remain fragmented.” The inspections are due back on Thursday, and whether the FSC confirms the Artex finding will decide how much of this becomes a template.
