South Korea Investigates Cyberattacks on Financial Firms Amid Possible AI Use

What happened? #

South Korean authorities are investigating a series of cyberattacks against financial companies after multiple firms reported incidents involving the exposure of customer information.

Police launched a formal investigation on October 6, 2026. The National Office of Investigation said it formed a 28-member investigation team to examine the attacks and possible violations of South Korea's information and communications network law. :chatgpt-content-reference{index="1"}

The investigation follows a series of incidents involving banks and other financial companies, including Shinhan Bank, KB Kookmin Bank and Hana Bank. South Korean financial authorities have also held emergency meetings and ordered financial companies to strengthen security checks. :chatgpt-content-reference{index="2"}

Which financial firms were affected? #

South Korean authorities and local reporting have identified multiple financial companies affected by the recent incidents.

The Korea Times, citing financial-sector information, reported that seven companies had reported information leaks: Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital. :chatgpt-content-reference{index="3"}

The nature and scale of the exposure differed between companies.

Shinhan Bank reported that information relating to approximately 25,000 customers had been leaked. Hana Bank reported exposure involving 89 customers. Woori Bank and NH NongHyup Bank were also targeted in similar attempts, but authorities and company reports said unauthorized access was blocked and no personal information was leaked from those incidents. :chatgpt-content-reference{index="4"}

What information was exposed? #

The information reported as exposed varied by incident.

For Shinhan Bank, reported information included customer names, phone numbers and annual income. Hana Bank reported that information belonging to 89 customers had been exposed. :chatgpt-content-reference{index="5"}

The Korea Times reported that more than 67,000 people were believed to have been affected across seven financial companies. Because the figure remains a reported estimate rather than a final independently established victim count, it should not be treated as a definitive total. :chatgpt-content-reference{index="6"}

Is AI confirmed to have been used? #

Not conclusively.

South Korean President Lee Jae Myung said on October 6 that details had emerged in some hacking cases suggesting the possible use of artificial intelligence. He called for a swift investigation to establish the circumstances and determine the appropriate response. :chatgpt-content-reference{index="7"}

Reuters reported that authorities have not disclosed the specific AI tools involved or the full extent of the breaches. :chatgpt-content-reference{index="8"}

Financial-sector reporting has described the incidents as suspected or presumed AI-assisted attacks. The Financial Supervisory Service has also identified IP addresses associated with the attacks and is investigating the incidents. However, the available evidence does not justify stating that AI was definitively responsible for carrying out the attacks. :chatgpt-content-reference{index="9"}

What did South Korean authorities do? #

South Korean financial authorities have taken several measures in response to the incidents.

The Financial Services Commission held emergency meetings with financial-sector organizations and called for security checks covering externally exposed systems, authentication and access controls. Authorities also instructed financial companies to share threat information, including attack IP addresses and attack methods, to support coordinated defensive measures. :chatgpt-content-reference{index="10"}

President Lee separately instructed the government to dedicate personnel and resources to minimizing damage from the attacks and called for a thorough investigation. :chatgpt-content-reference{index="11"}

Police have now established a 28-member investigation team and are examining potential violations of the information and communications network law. :chatgpt-content-reference{index="12"}

What is known about the attack infrastructure? #

The Financial Supervisory Service has identified IP addresses associated with the recent attacks across multiple countries.

Yonhap reported on October 6 that the watchdog had shortlisted 19 IP addresses in 12 countries and that industry sources believed they were associated with the recent attacks. The report said the addresses were presumed to have been used in hacking supported by AI agents. :chatgpt-content-reference{index="13"}

The identification of IP addresses does not by itself establish the identity or location of the attackers.

What happens next? #

The investigation remains ongoing.

Authorities are examining the attacks, the methods used to obtain customer information and whether AI technologies played a role. Financial companies are also reviewing externally accessible systems, authentication mechanisms and access controls following instructions from regulators. :chatgpt-content-reference{index="14"}

At this stage, there is no public confirmation identifying the attacker or attackers behind the incidents.

There is also no sufficient evidence to state that a particular AI model or tool was definitively used by the attackers.

Why this matters #

The incidents highlight a growing concern for financial-sector security: attackers may be able to combine conventional intrusion techniques with increasingly capable AI tools.

However, the South Korean investigation is still determining exactly how AI may have been involved. Treating suspected AI assistance as a confirmed technical finding would go beyond the evidence currently available.

For financial organizations, the immediate lesson is to review externally exposed systems, authentication controls, access permissions and monitoring capabilities while investigations continue.

Bottom line #

South Korea is investigating a series of cyberattacks that exposed customer information at multiple financial firms. Police have formed a 28-member investigation team, while financial regulators have ordered broader security checks.

South Korean President Lee Jae Myung has said that some hacking incidents show signs of possible AI use. However, the specific AI tools involved and the precise role AI played have not been publicly established.

The investigation is ongoing, and further technical findings could change the understanding of how the attacks were conducted.