An emergency gathering of South Korea's Financial Services Commission took place in response to a coordinated campaign of cyberattacks against the nation's banking sector. The meeting resulted in confirmation that Shinhan Bank had experienced a data breach, alongside reports of security incidents at other major financial institutions, notably Kookmin Bank.

Both Shinhan Bank and KB Kookmin Bank rank among South Korea's largest privately held commercial banks, each managing assets exceeding $400 billion. Authorities initiated on-site investigations following breach notifications and distributed relevant findings to partner agencies, including KISA, the country's data protection authority.

The FSC issued a directive requiring all financial institutions to take immediate action across multiple fronts:

  • Review all externally accessible infrastructure and applications, including systems not directly used by customers
  • Minimize unnecessary data exposure and audit authentication mechanisms and permission structures for gaps or weaknesses
  • Establish rapid information-sharing protocols and synchronize incident response efforts across institutions
  • Deliver completed security audits to regulators without delay

Officials committed to monitoring safeguards for depositors and compensation processes while conducting a comprehensive review of the incidents to determine what regulatory changes may be warranted.

South Korea's President Lee directed a comprehensive review into unauthorized disclosure of personal information affecting both financial and government agencies, according to statements from local news organizations. Separately, Hana Bank disclosed that its customer-support infrastructure had been compromised in a breach of limited scope.

The scale of the data exposure became clearer through media reports: Shinhan Bank's breach affected 25,000 customer records, while Kookmin Bank's incident exposed credit card details belonging to 119,000 individuals.

AI-powered attacks suspected

Government representatives have not publicly identified the attackers responsible for the incidents. However, the Yonhap news agency reported that an attacker-controlled server contained an HTML page header referencing a Chinese-language identifier connected to ARTEX AI.

ARTEX AI functions as an open-source framework designed for penetration testing, employing autonomous agents to streamline reconnaissance activities, identify security gaps, construct exploitation sequences, deploy security utilities, and validate discovered weaknesses.

Neither banking authorities nor financial regulators have confirmed that ARTEX AI played a role in the Shinhan breach, and the presence of the Chinese-language reference alone does not establish a connection to any specific threat group. Nevertheless, Moon Jong-hyun, director of the Genian Security Center, shared an assessment on LinkedIn stating that multiple security researchers believe the breaches employed AI-driven automation for attack execution.