Korean bank breaches run with the ARTEX AI hacking agent

The chain

The report, the responsible party’s response, the fix they claimed, whether anyone independent checked, and where it stands. A company saying it fixed something and evidence that the fix worked are different rows.

1. Reported Oct 2, 2026

   Shinhan, KB Kookmin and Hana disclosed customer-data leaks on Oct 2 after detecting abnormal access on Sep 29-30; Korea's Financial Security Institute found ARTEX-related traces in Shinhan's logs on Oct 3, and CrowdStrike reported on Oct 7 that an unknown, likely Chinese-speaking operator ran the open-source ARTEX agent (mainly on DeepSeek v4.1-flash, with GLM-5.3, Grok 4.6 and Claude Code sessions) against the banks. source

2. Response Oct 19, 2026

   Regulators put the sector on highest alert Oct 4 ('We cannot rule out the possibility that AI was used'), President Lee ordered a swift investigation Oct 6, police opened a formal probe with a 43-person team, and on Oct 14 the FSC's second emergency meeting counted 16 firms breached and about 100,000 records exposed, warning the number 'could expand.' At the Oct 19 National Assembly audit the five major bank CEOs apologized and FSS governor Lee Chan-jin said it would probably be the first case in which a CEO's responsibility for a cyber hack is addressed, with severe sanctions possible. The Guangdong suspect named by CrowdStrike reportedly denies involvement. source

3. Claimed fix Oct 8, 2026 partial

   Banks blocked attacker addresses and took the exposed side systems offline (Shinhan Oct 1, BNK Busan Oct 2); the FSC ordered every bank, card issuer and savings institution to inspect externally exposed systems, fix or block services missing authentication, restrict staff tools to pre-registered devices and run a 12-item emergency check. The ARTEX developer announced on GitHub (Oct 8) that the tool 'will no longer be updated and will transition to closed source' because it 'had been misused' - which does not recall copies already downloaded or derivative forks. source

4. Independent check Oct 18, 2026 partial

   The regulators' own check is the only test so far: 130 of 555 firms inspected reported security-management deficiencies (Oct 14), and the FSS began on-site inspections at Yegaram and Welcome savings banks (Oct 13) and OK Savings Bank (Oct 18). The sector-wide measures did not stop new attacks: OK Savings Bank was hit again on Oct 15, four days after its first breach, exposing 268 more customers' balances and account numbers. No independent forensic report and no police attribution has been published. source

5. Where it stands Oct 22, 2026 ongoing

   Attacks and disclosures are still accumulating (16 firms, about 100,000 records, a repeat hit on Oct 15), the police investigation has produced no arrest, and Microsoft's Oct 21 report that China-aligned Storm-0940 used the same ARTEX framework against ConnectWise customers shows the tool is in wider use. source

What would change the verdict

A police attribution or arrest plus a final FSS/FSC finding (and sanctions), with no new breaches for several weeks, would close the incident.