News Cyber Attacks

CrowdStrike says AI tools were used in South Korean bank breaches

CrowdStrike says a likely financially motivated, Chinese-speaking attacker used the ARTEX AI pentesting agent and AI coding tools in a campaign against South Korean financial institutions. Shinhan Bank says about 25,000 customers were affected; Korean police are investigating.

Published Updated
Illustration of a bank vault door with a translucent AI circuit pattern probing its edges, set against a dark blue city skyline.

Key takeaways

  • CrowdStrike says an attacker used the ARTEX AI pentesting agent and AI coding tools against South Korean financial institutions.
  • It assesses with moderate confidence that the attacker is a financially motivated Chinese speaker, not a named group.
  • Shinhan Bank says about 25,000 customers were affected; KB Kookmin says 119.
  • The breached systems were secondary services, not core banking.
  • Korean police are investigating and have not confirmed CrowdStrike's findings.

CrowdStrike says an attacker used AI tools in a campaign against South Korean financial institutions from late September to early October 2026, Reuters and Infosecurity Magazine reported on 8 October. At least nine South Korean banks have disclosed attacks or been reported as targets since late September, according to Reuters.

Which banks were affected? #

Bank What it disclosed Reported by
Shinhan Bank About 25,000 customers affected The bank, 1 October
KB Kookmin Bank 119 customers affected The bank, via Reuters
Hana Bank A leak, no count given Financial industry sources, via The Korea Herald
BNK Busan Bank A leak, no count given Financial industry sources, via The Korea Herald

Shinhan Bank said an outside party bypassed authentication on a platform that loan brokers use to store customer data during loan applications. The exposed data includes names, phone numbers, annual income and loan limits, and 66 cases included resident registration numbers, The Korea Times reported. Chief executive Jung Sang-hyuk apologised and said the bank would take full responsibility for any losses.

What did CrowdStrike find? #

In a blog post on 7 October, CrowdStrike said, according to Reuters and Infosecurity Magazine:

  • The attacker is likely a Chinese speaker and financially motivated. CrowdStrike gave this moderate confidence and has not attributed the activity to a named group.
  • The attacker mainly used ARTEX, an open-source AI pentesting agent developed in China, to find vulnerabilities and compromise specific services. ARTEX connects to outside language models; CrowdStrike named DeepSeek and Zhipu AI's GLM among the backends used.
  • The attacker also used Anthropic's Claude Code, and asked Claude for help finding Korean Telegram groups that sell breached data.
  • All the attacks were linked to one IP address hosting an ARTEX instance. A second address in Hong Kong held open directories with AI coding session histories and ARTEX configuration files.

"AI tooling can enable a financially motivated threat actor to conduct multiple intrusions within a short time span," CrowdStrike wrote, as quoted by Infosecurity Magazine.

Korean authorities had not confirmed CrowdStrike's findings when Reuters reported them. Anthropic did not immediately respond to Reuters' request for comment.

How are Korean authorities responding? #

  • On 2 October the Financial Services Commission (FSC) held an emergency meeting and ordered banks and card companies to check every IT system reachable from outside networks, The Korea Herald reported.
  • The FSC, the Financial Supervisory Service and the Financial Security Institute began on-site inspections and shared attacker IP addresses and methods with the Korea Internet and Security Agency.
  • On 6 October the FSC warned customers of the affected firms to watch for phishing and loan scams, Infosecurity Magazine reported.
  • South Korean police opened an investigation, and President Lee Jae Myung called for a robust response, according to Reuters.

What should banks and their customers do? #

Customers of the affected banks should treat calls, texts and loan offers that use their personal details with suspicion, as the FSC advises. Shinhan Bank has set up a page and an app feature for customers to check whether their data was exposed.

For financial firms, the FSC's instructions are a useful checklist: inventory externally reachable systems, reduce unnecessary data exposure, and review authentication and access controls. The breached systems at Shinhan and KB Kookmin were secondary services, a loan broker platform and an employee mobile work-support system, not core banking.

Sources

  1. Reuters report on CrowdStrike's findings, iTnews (Reuters)
  2. Details from CrowdStrike's analysis of the campaign, Infosecurity Magazine
  3. Shinhan Bank breach details, The Korea Times
  4. Regulator orders security checks after bank breaches, The Korea Herald
  5. South Korea's investigation of the bank breaches, BleepingComputer

Questions this raises

Did AI carry out the attacks on its own?
CrowdStrike describes a human attacker using AI tools, mainly the ARTEX agent, to find and exploit weaknesses faster. It does not describe a fully autonomous attack.
Who is the attacker?
CrowdStrike assesses with moderate confidence that the attacker is a financially motivated Chinese speaker. It has not attributed the activity to a named group, and Korean authorities have not confirmed its findings.
What should affected customers watch for?
Phishing and loan scams that use their personal details, as the Financial Services Commission warned on 6 October.

South KoreaBanking SecurityData BreachAI SecurityThreat Intelligence