A string of AI-driven cyberattacks on Korean financial companies has left customers anxious. Some are banding together to sue over the companies' failure to protect their information, while others have resigned themselves to the idea that their “personal” information may not be so personal any more.
The breaches follow mass data leaks at telecom carriers and online platforms whose culprits have yet to be identified or caught. This time, the targets are the holders of people's money.
Seven financial companies have reported breaches so far: Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital, according to the financial industry on Monday. Shinhan Bank said information on about 25,700 customers had leaked, and Yegaram Savings Bank put its toll at roughly 40,000.
Victims have formed groups and are recruiting members for class-action damages suits.
“People in the same situation need to at least pool information,” said a victim who opened an online community for a class-action suit over the Shinhan Bank breach on Friday. “If your information was leaked, take screenshots ahead of time, and if you get a strange call, write down the date and what was said.”
Others have resigned themselves to the state of information security. “Is personal information public property now?” one comment asked. Another social media post asked, “Even banks with firewalls and solid systems got hacked, so what can we do?” A third said, “At this rate, I will have to keep a pile of cash at home.”
“My personal information has been leaking ever since the SK Telecom incident,” a Shinhan Bank hack victim posted to an online community. “I would not even be surprised if there were one more person overseas using my information.”
Comments posted to a Naver Cafe on Oct. 1 react to news of the hacking of financial companies, with one asking whether personal information is “public property now.”SCREEN CAPTURE
The worry is that data stolen in one breach can be matched with data stolen in another.
“This incident is very concerning in that previously leaked personal information can be combined with financial information,” said Hwang Seong-ho, head of virtual private network company NordVPN's Korea branch. “Authorities must quickly take whatever measures they can.”
The National Police Agency's Cyber Bureau is tracking traces of Artex AI found at internet addresses used to attack the banks. Artex AI is a Chinese-language, open-source penetration-testing tool published on GitHub that uses AI to probe systems for weaknesses.
Because the tool is publicly available, experts say the attacks cannot be pinned on China.
“It has not been confirmed whether Artex was the only tool used in the attacks, so no one should conclude at this point that 'Chinese AI did the hacking,'” said Kim Seung-joo, a professor at Korea University's Graduate School of Information Security.
Authorities plan to seek international cooperation to identify the attackers, who routed the attacks through overseas IP addresses.
But with investigations into earlier mass data leaks stalled, doubts remain about how quickly the probe can move.
SK Telecom's headquarters in Jung District, central Seoul, is seen on May 6.NEWS1
Police investigating the April 2025 leak of USIM data at SK Telecom have reportedly traced more than 100 IP addresses and worked with 31 information technology companies in 14 countries but have yet to identify a suspect.
In two other cases that differ in nature from outside hacking — unauthorized mobile micropayments at carrier KT and a personal data leak at Coupang — Korea's largest e-commerce platform, police have identified suspects. But the prevailing view is that they are unlikely to be taken into custody.
“In data leak investigations, even when we manage to find traces of the crime, identifying a suspect is very difficult,” a police official said. “We also have to weigh the risk of diplomatic friction during the investigation.”
The attacks have also reconfirmed how low the barrier to cyberattacks has fallen, another source of public unease. Some analysts say ordinary people can now hack by misusing AI.
“There are cases where AI-based programs that plug in random passwords are openly traded on the market,” said a software developer at one of Korea's five largest brokerages. “Even without the skills, anyone who pays can use attack tools.”
Some have raised the possibility that the attacks on the financial sector were carried out by an ordinary individual rather than a professional hacking group.
Projected cyber code creates the silhouette of a hooded man holding a laptop computer in this picture taken on May 13, 2017.REUTERS/YONHAP
Experts say the incidents should not be treated merely as a side effect of AI's development but as a reason to review security systems.
“Whether AI was used is not the point,” Kim said. “The problem is that vulnerabilities were not properly managed. Each company's level of security needs to be examined across the board.”
Attackers also targeted Woori Bank and NH NongHyup Bank, but no damage has been confirmed.
“We need to move toward using AI to block AI, such as by using high-performance AI to find vulnerabilities first,” said Youm Heung-youl, a professor emeritus of information security engineering at Soonchunhyang University.
This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
