The breaches in brief
Between 1 and 5 October 2026, seven South Korean financial institutions confirmed data breaches, exposing about 66,000 individuals and 2,200 corporate records, according to the Korea Herald. Shinhan Bank disclosed first on 1 October; by 5 October KB Kookmin, Hana, BNK Busan, Yegaram Savings, Welcome Savings and Hyundai Capital had followed. The Korean National Police Agency assigned 28 investigators in four teams from its cyberterrorism unit.
What makes the wave unusual is the suspected tooling. Bloomberg, citing Yonhap, reported on 2 October that AI tools were suspected in the Shinhan intrusion, and researchers found a Chinese-language page title translating roughly as “AI autonomous penetration testing console” on related infrastructure. President Lee Jae Myung said signs of AI use had emerged and ordered a thorough investigation.
The entry points, though, were ordinary: peripheral, internet-facing apps with weak authentication. That is exactly the surface a penetration test and security audit is meant to find before an automated attacker does.
Which institutions were hit, and what leaked?
Shinhan Bank disclosed the first incident on 1 October, reporting about 25,700 affected customers. Over the following days KB Kookmin Bank, Hana Bank and BNK Busan Bank reported incidents, then savings banks Yegaram and Welcome and the lender Hyundai Capital. Woori Bank and NH NongHyup Bank were also reportedly targeted, without confirmed data leaks.
The exposed fields are the ones fraudsters value: names and phone numbers paired with income, borrowing limits and, in some cases, resident registration numbers. Individual counts varied widely by institution — some disclosures covered only dozens of people — and local reports have differed on per-bank figures, so we cite the combined total published by the Korea Herald on 6 October.
The Financial Services Commission held an emergency meeting and told all financial firms to inspect externally accessible systems, reduce unnecessary data exposure, verify authentication controls and share threat information. The Financial Supervisory Service identified 28 IP addresses linked to the attempts and set a short deadline for internal security checks.
What role did AI play?
The AI link rests on forensic traces, not a confirmed attribution. A server believed to be part of the Shinhan intrusion carried an HTML title in Chinese describing an autonomous AI penetration-testing console. Researchers associated it with ARTEX, an open-source framework that uses LLM agents to automate reconnaissance, vulnerability discovery, attack-path planning, tool execution and exploit verification. BleepingComputer, reporting on 5 October, noted that authorities have not confirmed the tool’s use, and local experts describe a human operator directing it.
That nuance matters. The likely model is not a fully autonomous AI hacker but a small team using agentic tooling to scan many targets, chain findings and test login paths at a pace that used to require far more people. The same category of tools is sold and open-sourced for legitimate red-teaming. Its arrival on the offensive side compresses the time between “a weak endpoint exists” and “it gets exploited”.
How did attackers get in?
According to the Korea Times, the reported entry points were systems at the edge of the bank, not core ledgers:
- Shinhan: an authentication bypass on a loan-agent status-checking service — a partner-facing lookup page.
- KB Kookmin: abnormal external access to an employee mobile system.
- Hana: unauthorized access to a sales-support system.
Local reporting also describes credential stuffing — automated logins with leaked passwords. None of this requires novel exploits. It requires finding auxiliary apps that return customer data, trust the client, or lack rate limits — work an AI agent does tirelessly.
What it means for US & EU software teams
Your weakest app defines your breach. Banks harden core platforms and internet banking. Agent portals, broker lookups, staff mobile back ends and sales tools are often built quickly by different vendors and reviewed less. For FinTech companies and their suppliers, these are now first-class attack surface.
Annual pentests no longer match attacker tempo. If an adversary can point an agent at hundreds of hosts and iterate overnight, a once-a-year assessment leaves months of exposure. Expect regulators and enterprise buyers to ask for continuous or release-gated testing, attack-surface monitoring and evidence that findings are fixed.
Regulatory clocks are short. EU financial entities under DORA must classify and report major ICT incidents on tight timelines, and New York’s NYDFS Part 500 requires notice of cybersecurity events within 72 hours. A breach through a vendor-built portal is still the institution’s incident, so contracts with software suppliers need security testing and disclosure obligations written in.
Data minimization is a security control. A status-check page that only needed “approved / pending” but returned income and loan limits turned an auth bug into a reportable breach. Designing APIs to return the minimum fields limits the blast radius of the next bypass.
A hardening checklist for internet-facing financial apps
- Inventory everything reachable. Include partner and agent portals, staff mobile APIs, marketing and sales tools, and forgotten staging hosts.
- Enforce auth server-side on every route. No client-side checks, no “hidden” endpoints, object-level authorization on every record lookup.
- Stop credential stuffing. Phishing-resistant MFA for staff, rate limits and bot detection on login, breached-password checks.
- Return the minimum. Trim API responses to what each screen needs; mask identifiers and financial fields by default.
- Test continuously. Run automated scanning in CI and on a schedule, and add manual pentests on new external services before launch.
- Watch for agentic patterns. Alert on high-volume, systematic probing across many endpoints and on unusual enumeration of IDs.
Frequently asked questions
What happened at the South Korean banks?
Between 1 and 5 October 2026, seven South Korean financial institutions confirmed data breaches: Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital. According to the Korea Herald, about 66,000 individuals and 2,200 corporate records were exposed, including names, phone numbers, resident registration numbers, annual income and loan limits. Shinhan alone reported about 25,700 affected customers.
Was AI really used in the attacks?
It is suspected, not confirmed. Bloomberg, citing Yonhap, reported on 2 October that AI tools were suspected in the Shinhan hack, and researchers found a Chinese-language page title reading roughly ’AI autonomous penetration testing console’ on a server linked to the intrusion. That string has been associated with ARTEX, an open-source LLM-based penetration-testing framework. President Lee Jae Myung said signs of AI use had emerged, but authorities have not formally confirmed the tool.
How did the attackers get in?
Reported entry points were peripheral, internet-facing systems rather than core banking: an authentication bypass on Shinhan’s loan-agent status-checking service, abnormal external access to an employee mobile system at KB Kookmin, and an unauthorized access attempt on Hana Bank’s sales-support system. Local reporting also describes credential stuffing, meaning automated logins with stolen passwords.
What should US and EU fintech teams do now?
Inventory every externally reachable application, including partner portals, agent status pages and staff mobile back ends; enforce server-side authentication and authorization on every endpoint; add rate limiting and credential-stuffing defenses; minimize the personal data those systems return; and test continuously, because AI-assisted attackers can probe a large attack surface far faster than an annual penetration test cycle.
Sources
Bloomberg — AI Tools Suspected in Korea’s Shinhan Bank Hack, Yonhap Says (2 October 2026)
The Korea Herald — Police launch major probe as suspected AI hacks sweep through banks (6 October 2026)
The Korea Times — Shinhan, Kookmin, Hana data breaches fuel concerns over AI-powered cyberattacks (2 October 2026)
BleepingComputer — South Korea probes bank breaches amid suspected AI-powered attacks (5 October 2026)