AI-assisted breaches at seven lenders stall South Korea's plan to loosen bank network rules
South Korea's FSC paused a plan to open bank network-separation exemptions to 75 firms after ARTEX-assisted hacks breached seven financial firms. The pause holds back at most 15 exemptions while regulators work out whether the attacker got in through the rule they were loosening or around it.
The Investor · Invest desk
What happened
- The breaches began on September 30 at Shinhan Bank, where an outsider got past identity checks in a loan-agent service and took personal data on roughly 25,000 customers.
- Yegaram Savings Bank disclosed the largest single breach, about 40,000 customers, while Welcome Savings Bank lost up to 2,200 corporate records and Hyundai Capital data on 146 loan agents.
- The Korea Financial Security Institute named ARTEX AI, an open-source large-language-model penetration-testing system shared on GitHub, as the common thread across the attacks.
- The FSC says it needs further review with the Financial Supervisory Service while it contains the breaches, and that it still supports deregulation in principle.
Why it matters
- What it limits constraint Firms the second round was opening to, down to 2 trillion won in assets and 300 staff, stay behind the full internet wall and cannot test AI detection tools under exemption until the review ends.
- Who's exposed exposure Banks cannot close these incidents by blocking addresses, since each saw two or three overlapping IPs and the intruder moved on when one was cut, so containment has no fixed end date.
- What it costs cost Firms that planned AI-security work around the October 7 selection now have to budget for a regulator willing to stop a round one day out, even while it says it backs the policy.
Next story · Leadership · Oct 8
CrowdStrike traces AI-assisted attacks on South Korean banks to one possible suspect in GuangdongConfirmed6 publishers
KB Kookmin took close to 68 hours to spot its breach, Hana nearly 42 and Shinhan more than 15 [12]. At the slow end that is nearly three days [22]. The two slower banks checked their logs after the FSC circulated the attacker's IP addresses from the Shinhan case [7]. Regulators had built the exemptions on this problem, arguing that the network-separation rule kept banks from running the AI tools they needed to detect threats [15].
The record counts run opposite to the dwell times. Adding every reported figure gives roughly 68,292 exposed records of mixed kinds, counting customers, corporate records, outsourced developers and loan agents together [19]. Shinhan's 25,727 and Yegaram's 40,000 make up about 96% of that [20]. KB Kookmin and Hana together lost 208 [21].
Both camps can use these numbers. The deregulators' reading is that 42 and 68 hours of undetected access is the case for AI detection inside the wall. The other reading is that the attacker brought AI too. Analysts found a console string naming ARTEX on servers tied to the Shinhan attack, and the tool won an offensive-security contest run by Baidu's security response center this year [3]. The FSC had that second reading on its agenda before the breaches: Vice Chairman Kwon Dae-young convened a roundtable on advanced-AI security risks in May [18].
The account does not say which of the seven firms held first-round exemptions, or whether any breached system was reachable because of one. At Shinhan the way in was the identity checks on a loan-agent service [6]. An institute official said the tool did not act alone, and that the internal employee and partner systems the hacker reached had been "managed less rigorously" than services offered to the public [9]. Both describe weak access controls. The rule under review governs whether internal business systems are physically walled off from the internet [13].
The pause also defers less than the 75 figure implies. The account describes the first round as covering 49 firms, each with a one-year exemption [16], and also says the number chosen was to rise from 10 to as many as 15 [17]. Those counts do not reconcile. On either reading, the second round would have added 26 eligible firms [23] and no more than 15 selections. Instead of picking them on October 7, FSC staff are on containment [11].
From here the FSC can resume selections on the same terms once the review closes, run a smaller round, or bring exemptions back with conditions on partner and employee systems. I'd expect the third, because the regulator has said it still backs the policy [11] and the institute placed the weakness in those systems [9]. The counter-case has history. In 2017 WannaCry left Korean finance largely unscathed because malware could not reach isolated networks [14]. A regulator could take that as reason to hold the wall at the first-round bar of 10 trillion won in assets and 1,000 staff [16]. If forensic findings put the breached systems inside exempted networks, the pause becomes a rollback and this view is wrong.
What to watch
- A new date for second-round selections, and whether the 2 trillion won asset bar and 300-staff floor survive the FSS review.
- Further breach disclosures from financial firms checking their logs against the attacker addresses the FSC circulated.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption35
- Hype gap+30
- Incentives45
- Confidence60
Perspective Coverage
8 publishers- Builder
- Builder 38%
- Operator
- Operator 41%
- Investor
- Investor 21%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
AI-assisted hackers used the Chinese open-source tool ARTEX to breach seven financial firms, exposing tens of thousands of customer records.
- [2]
The Korea Financial Security Institute says the common thread in the hacks is ARTEX AI, an open-source large-language-model penetration-testing system distributed on GitHub mainly within Chinese-speaking circles.
- [3]
Analysts reportedly spotted an ARTEX Autonomous Penetration Testing Console string on servers tied to the Shinhan attack; the tool won an offensive-security contest run by Baidu's security response center this year.
- [4]
Reportedly 25,727 records were breached at Shinhan, 119 at KB Kookmin Bank, 89 at Hana Bank, and data on 11 outsourced developers at BNK Busan Bank.
- [5]
Yegaram Savings Bank disclosed a breach affecting about 40,000 customers, the largest single figure; Welcome Savings Bank lost up to 2,200 corporate records and Hyundai Capital exposed data on 146 of its mortgage loan agents.
- [6]
The breaches began on September 30 at Shinhan Bank, where an outside party slipped past identity checks in a loan-agent service and pulled the personal data of roughly 25,000 customers.
- [7]
After the Shinhan breach was discovered, the FSC circulated the attacker's IP addresses, leading other firms to check their own logs and find that their systems had also been breached.
- [8]
South Korea's Financial Services Commission suspended the second round of its network-separation deregulation, due October 7, pausing it a day before the next set of banks were to be picked.
- [9]
An institute official said the tool did not act alone and was used by a hacker to extract internal employee and partner systems data, which had been "managed less rigorously" than services offered to the public.
- [10]
The institute said two or three IPs overlapped at each bank, blocking one pushed the intruder to another, and the activity was still live.
- [11]
The FSC says it needs further review with the Financial Supervisory Service while it contains the breaches, and insists it still backs deregulation in principle.
- [12]
Shinhan reportedly took more than 15 hours to spot its breach, Hana nearly 42 hours, and KB Kookmin close to 68 hours.
- [13]
Korea's network separation rule requires financial companies to keep internal business systems physically walled off from the internet; it was imposed after late-2000s cyberattacks, covering public agencies from 2007 and banks from 2014.
- [14]
During the 2017 WannaCry outbreak, Korean finance escaped largely unscathed because malware could not reach isolated networks.
- [15]
Regulators argued the network-separation rule blocked banks from running the AI tools they needed to detect threats, so the FSC began carving out exemptions on the premise that AI would strengthen defenses.
- [16]
The first round of relaxation covered 49 firms with at least 10 trillion won in assets and 1,000 staff, each granted a one-year exemption to test AI-driven defenses.
- [17]
The second phase was to grow eligibility to 75 companies, cutting the asset bar to 2 trillion won and the headcount floor to 300, with the number of firms chosen rising from 10 to as many as 15; selections were scheduled for October 7.
- [18]
FSC Vice Chairman Kwon Dae-young convened a roundtable in May on advanced-AI security risks.
- [19]
Reported exposed records across the seven firms total roughly 68,292, mixing customers, corporate records, developers and loan agents.
- [20]
Shinhan and Yegaram account for about 96% of reported exposed records.
- [21]
KB Kookmin and Hana together lost 208 records.
- [22]
KB Kookmin's detection time of close to 68 hours is nearly three days.
- [23]
The second round would have added 26 eligible firms.
- [24]
The second round would have cut the asset threshold to one-fifth of the first round's, opening eligibility to firms with 2 trillion to 10 trillion won in assets and 300 or more staff.
Sources
7 independent publishers whose own reporting we read for this story.
- asia.nikkei.comAI tools identified as part of cyberattacks on South Korean banks - Nikkei Asia
1 article · October 7, 2026
- channelnewsasia.comCrowdStrike says China-based suspect used AI tools in South Korean bank hacks
1 article · October 7, 2026
- cryptobriefing.comCrowdStrike says hacker behind South Korean bank attacks likely operated from China
1 article · October 8, 2026
- cryptopolitan.comKorea suspends bank security deregulation after AI tool fuels hacking spree
2 articles · October 7, 2026
- en.sedaily.comChinese Open-Source AI Agent Traced in Hacking of Korean Financial Firms
4 articles · October 8, 2026
- en.yna.co.krChinese-speaking hacker possibly linked to AI-driven attacks on S. Korean banks: report
1 article · October 7, 2026
- koreajoongangdaily.comChinese-speaking hacker possibly behind attack on Korean banks, CrowdStrike says
1 article · October 7, 2026
- seekingalpha.comCrowdStrike links South Korean bank hacks to China-based attacker using AI (CRWD:NASDAQ) | Seeking Alpha
1 article · October 8, 2026
Topics and entities
Topics
- AI Penetration Testing
- Network separation regulation
- AI-Assisted Cyberattacks
- Financial Sector Cybersecurity