Lone hacker's AI-agent campaign linked to Korean bank breaches
Since late September a wave of breaches has hit internet-facing systems at South Korean banks, savings banks and fintechs. CrowdStrike says ARTEX, an open-source AI hacking agent running mainly on DeepSeek, was likely behind the bank attacks, and profiles the operator as a financially motivated Chinese speaker who also used Claude Code. Regulators put exposure across seven firms at about 68,000 records; President Lee ordered a full investigation.
Damage
About 68,000 records exposed across seven financial firms (largest: Yegaram Savings ~40,000, Shinhan ~25,000); more banks attacked but blocked
Inside the incident
How it happened
The targets were secondary, externally exposed systems — a loan-broker status site, mobile staff tools, sales-support apps — rather than core banking. The agent mostly reused known techniques, at machine speed, against many institutions at once. Woori and NH Nonghyup were hit with the same methods, but their intrusion-prevention and access controls stopped them.
The AI’s role
AI multiplied one person's reach rather than inventing anything new. CrowdStrike says the ARTEX instance ran mainly on DeepSeek v4.1-flash, with GLM-5.3 and Grok 4.6 in later sessions; the actor also used Claude Code and asked Claude questions, such as where Korean breach data is sold. On Oct 4 Korea's Financial Security Institute said the savings-bank attacks came from different IPs; by Oct 12 regulators reported the same attacker IPs across all seven affected firms, though the FSS cautions that IP-based attribution can mislead.
Damage so far
The largest leak was at Yegaram Savings Bank (an estimated 40,000 people), followed by Shinhan (about 25,000 customers, including some resident registration numbers). Smaller leaks hit KB Kookmin (119 customers), Hana (89), Welcome Savings (about 2,200 corporate-client records), Hyundai Capital, BNK Busan and two fintechs. Regulators put combined exposure across seven firms at about 68,000 records and say it may rise. Hana says its core account and transaction systems were unaffected.
Why it matters
It shows what AI-scaled crime looks like in practice: no new exploit, just one operator covering far more ground. Seoul's response — an emergency regulator meeting, a sector-wide highest alert and a presidential order to investigate — is a template other financial regulators may follow.
Every organization named, the map and the full timeline on the index →
Organizations affected
- PFCTFintech, South Korea, Data leaked · 304 customers' data.
- Modu-daFintech, South Korea, Breach reported · Reported that an outside party illegally accessed its website on Sep 27; it blocked the IP and the bypass route. Number affected not given.
- Shinhan BankBanking (commercial), South Korea, Data leaked · ~25,000 customers' personal data leaked via a mobile loan-broker status site ('M-Shinhan'); included 66 resident registration numbers, 97…
- KB Kookmin BankBanking (commercial), South Korea, Data leaked · 119 customers affected; internal mobile staff work-support system hit; names, phone numbers, addresses and encrypted resident registration…
- BNK Busan BankBanking (regional), South Korea, Data leaked · Data of 11 outsourced developers exposed via a mobile sales-support system.
- Hana BankBanking (commercial), South Korea, Data leaked · 89 customers; Sales-support system (ODS) in the DMZ hit on Sep 30; leaked resident registration numbers, names, addresses, emails…
- Yegaram Savings BankBanking (savings bank), South Korea, Data leaked · ~40,000 people (estimate): names, phone numbers and birth dates; notice posted Oct 2.
- Welcome Savings BankBanking (savings bank), South Korea, Data leaked · ~2,200 corporate-client records (estimate): company names, contact names, emails, phone numbers; reported to regulator.
Timeline
- Oct 12Regulators put combined exposure across seven financial firms at about 68,000 records.source
- Oct 7CrowdStrike says ARTEX, an open-source AI hacking agent, was likely behind the bank attacks, and profiles the operator as a financially motivated Chinese speaker.source
- Oct 6President Lee says signs have emerged of AI being used in some of the hacks and tells officials to establish the facts swiftly and concentrate people and resources on limiting the damage.source
- Oct 4Emergency meeting: regulators put the financial sector on highest alert and fault banks' security basics. The Financial Security Institute says bank attacks shared an IP but savings-bank attacks did not, so a single actor can't be assumed.source
- Oct 3Welcome Savings Bank and Hyundai Capital report leaks.source
- Oct 2Shinhan, KB Kookmin and Hana disclose customer-data leaks.source
- Sep 30Hana Bank's support system is hit; Yegaram Savings Bank discovers a leak affecting an estimated 40,000 people.source
- Sep 29Shinhan and KB Kookmin detect abnormal access; signs of a leak are confirmed the next day.source
- Sep 27Fintech PFCT is breached (304 customers).source
What officials said
What it means next
A human adversary leveraging AI agents can run widespread attacks: it 'allows one human to target many customers in a very short period of time using the power of AI.'Adam Meyers (CrowdStrike)
Institutions must continuously inventory and inspect software, accounts and partner access, and not let an 'AI' narrative distract from banks' own basic-security responsibility.Kim Myung-joo (Seoul Women's Univ.)
AI did not create a new attack method; it automated and scaled existing attack steps, so defenders should expect speed and volume rather than novelty.SK Shieldus
Weak handling of security basics — exposed side systems and weak access control — was the decisive gap, and firms with MFA and access controls withstood the same attacks. FSC Chair Lee Eog-weon said banks were 'very lacking even in the very basic parts.'Weekly Kyunghyang analysis
In their words
“In some hacking incidents, signs have emerged of AI being used, causing considerable public concern and anxiety. … Please establish the circumstances swiftly and clearly, and concentrate personnel and resources on minimising the damage.”
“And this is significant because it allows one human to target many customers in a very short period of time using the power of AI.”
“We cannot rule out the possibility that AI was used in the attacks. … The entire financial sector must recognize the gravity of the situation and remain on the highest alert.”
Did they fix it?
- Reported Oct 2, 2026
Shinhan, KB Kookmin and Hana disclosed customer-data leaks on Oct 2 after detecting abnormal access on Sep 29-30; Korea's Financial Security Institute found ARTEX-related traces in Shinhan's logs on Oct 3, and CrowdStrike reported on Oct… source
- Response Oct 19, 2026
Regulators put the sector on highest alert Oct 4 ('We cannot rule out the possibility that AI was used'), President Lee ordered a swift investigation Oct 6, police opened a formal probe with a 43-person team, and on Oct 14 the FSC's… source
- Claimed fix Oct 8, 2026 partial
Banks blocked attacker addresses and took the exposed side systems offline (Shinhan Oct 1, BNK Busan Oct 2); the FSC ordered every bank, card issuer and savings institution to inspect externally exposed systems, fix or block services… source
- Independent check Oct 18, 2026 partial
The regulators' own check is the only test so far: 130 of 555 firms inspected reported security-management deficiencies (Oct 14), and the FSS began on-site inspections at Yegaram and Welcome savings banks (Oct 13) and OK Savings Bank (Oct… source
- Where it stands Oct 22, 2026 ongoing
Attacks and disclosures are still accumulating (16 firms, about 100,000 records, a repeat hit on Oct 15), the police investigation has produced no arrest, and Microsoft's Oct 21 report that China-aligned Storm-0940 used the same ARTEX… source
Sources
Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.
