South Korean bank data breaches

Overview

The cyberattack against Shinhan Bank has been further linked to traces of a Chinese-language, AI-based autonomous penetration testing tool identified as ‘ARTEX-自主渗透試控制台’ (AI Autonomous Penetration Test Console). The tool, an open-source system based on Large Language Models, was detected via Chinese strings in the HTML title of a suspected web server. While official confirmation of its use in the breach is pending, analysts suggest the attack may have employed ‘credential stuffing’ to bypass identity verification procedures in Shinhan’s loan solicitor service.

The scope of the security incidents has expanded, revealing a series of coordinated attacks targeting multiple South Korean financial institutions. Beyond Shinhan Bank’s leak of data for approximately 25,000 customers, additional breaches have been confirmed at KB Kookmin Bank (roughly 119 customers), Hana Bank (89 victims), and BNK Busan Bank (11 outsourced employees).

Experts note that attackers appear to be targeting secondary channels—such as loan recruitment services, employee mobile support systems, and sales support platforms—which may possess less stringent authentication protocols than core banking systems. In response, the Financial Services Commission has convened emergency meetings and ordered comprehensive security audits of all externally exposed IT assets. The National Police Agency has also launched an investigation into the incidents. Both Shinhan and KB Kookmin Bank have pledged to provide full compensation to customers if actual damages are confirmed.

Entities

ARTEX AI · Shinhan Bank · Hana Bank · Financial Supervisory Service · KB Kookmin Bank

Claims

What the coverage asserts, and how many sources carry each claim.

[● 8 SOURCES] Shinhan Bank confirmed that personal information for about 25,000 customers was leaked. www.imaeil.com · www.sisajournal.com · www.tfmedia.co.kr · biz.heraldcorp.com · www.hani.co.kr · +3 more
[● 6 SOURCES] KB Kookmin Bank confirmed a leak of approximately 100 to 119 customers' information via external intrusion. www.imaeil.com · www.tfmedia.co.kr · biz.heraldcorp.com · www.hani.co.kr · www.joseilbo.com · +1 more
[● 3 SOURCES] The Financial Services Commission held an emergency response meeting to address the series of banking sector data breaches. www.tfmedia.co.kr · biz.heraldcorp.com · www.seoul.co.kr
[● 3 SOURCES] Shinhan Bank and KB Kookmin Bank have pledged to provide full compensation to customers if actual damages are confirmed. www.tfmedia.co.kr · www.hani.co.kr · www.mbn.co.kr
[● 2 SOURCES] Security experts suggest the attacks may have utilized AI-based automated tools like ARTEX AI. www.sisajournal.com · www.joseilbo.com
[○ 1 SOURCE] Hana Bank confirmed the leak of information belonging to 89 customers. www.joseilbo.com
[○ 1 SOURCE] BNK Busan Bank confirmed the leak of personal information for 11 outsourced employees. www.joseilbo.com
[○ 1 SOURCE] The National Police Agency's Cyber Terror Response Investigation Unit has launched an investigation into the hacking incidents. www.joseilbo.com

Timeline

1 day ago

[BUSINESS] 11 sources
South Korean banks hit by series of hacking attacks and data breaches
Multiple South Korean banks, including Shinhan and KB Kookmin, suffered hacking attacks that leaked customer data. Authorities suspect the use of AI-driven tools and have ordered emergency security audits.
1 day ago

[TECHNOLOGY] 5 sources
Shinhan Bank cyberattack linked to Chinese AI penetration tool
Traces of a Chinese-language AI penetration tool, ‘ARTEX AI’, were found on a server linked to a cyberattack on Shinhan Bank, raising concerns over automated credential stuffing attacks.

Sources

biz.heraldcorp.com · chosunonline.com · dailymagazine.co.kr · english.hani.co.kr · hidomin.com · imaeil.com · ithome.com · joseilbo.com · kyeonggi.com · mbn.mk.co.kr · sateconomy.co.kr · seoul.co.kr · sisajournal.com · tfmedia.co.kr

This summary has been updated 1 time: see revision history