Hacks suspected of using artificial intelligence (AI) agents led to customer personal information being leaked through employee-facing business-support systems at several financial companies. As of October 4, leaks had been confirmed at 7 institutions, and reports said attack attempts had been identified at a minimum of 9–10. Shinhan Bank (신한은행) reportedly had 25,727 items of customer personal information leaked, while at Yegaram Savings Bank (예가람저축은행), the names, dates of birth, contact details and other information of about 40,000 people were reportedly exposed. The central issue in this incident is that vulnerabilities in financial companies’ internal business networks can directly affect customers’ personal information and financial safety.

Background and context

The attacks were described not as a campaign focused on one company, but as attempts against multiple financial companies, with attackers then finding and exploiting vulnerable points. An editorial reported that an AI agent carried out random attacks on multiple financial companies and exploited gaps in their defenses. However, subsequent reports said that similarities in the timing and methods of the attacks raised the possibility that they were carried out by the same group, while also noting that it had not been confirmed whether AI was actually used in the attacks.

The route in question was not customer internet or mobile banking, but systems used by employees or people connected with the business. Reported attack routes included Shinhan Bank’s loan-status lookup service for loan applications submitted by loan counselors, KB Kookmin Bank’s (KB국민은행) employee mobile business-support system, and Hana Bank’s (하나은행) employee sales-support system. The incidents show how internal services with less stringent authentication or relatively weaker security management than customer-facing systems can become a weak link.

According to subsequent reports, information on 119 customers at Kookmin Bank and 89 customers at Hana Bank was confirmed to have been leaked. At Busan Bank (부산은행), information on 11 outsourced development staff members was exposed during an attempted attack on an external web server. Woori Bank (우리은행) and NH Nonghyup Bank (NH농협은행) were also reportedly targeted in similar attacks, but the attacks did not lead to actual leaks. In the non-bank financial sector, it was confirmed that information on 146 loan agents at Hyundai Capital (현대캐피탈) had been leaked. Reports said that attacks were attempted against the Korea Federation of Community Credit Cooperatives (새마을금고중앙회) and Nonghyup Mutual Finance (농협 상호금융), but were blocked or defended against.

An editorial reported that the attacks were likely to have used ARTEX AI (아텍스 AI), an autonomous penetration-testing platform based on a large language model (LLM)—an AI system trained on extensive text data to understand and generate writing—that was released as open-source software in the Chinese-speaking world. However, its use has not been confirmed. The fact that a tool’s name or origin has been mentioned does not mean that the actual attack methods or those behind the attacks have been identified.

What this means

What matters to customers is not only that a hack took place, but also what information was leaked and how it could be misused. The leaked information described in reports included names, contact details, annual income, employer names, addresses and email addresses; some encrypted resident registration numbers were also mentioned. The financial sector said that the attacked systems were separate channels from financial transaction systems, and that transaction information such as account numbers had not been leaked. Even so, if information related to loan consultations or income is combined with other personal information, it could be used for targeted phishing or voice phishing in which the caller appears to know the details of an actual consultation.

For example, someone who had a loan consultation could receive a text or phone call from a person who appears to know the actual consultation details, their employer or their income, and mistake that person for a financial company employee. This is a possibility of secondary harm raised in reports, not harm that has been confirmed to have occurred. It is also worth noting that financial companies said they would notify affected customers individually about the leaks and how to prevent harm, and that they would fully compensate customers for losses caused by these incidents.

The incidents show that internal systems cannot be assumed to pose little risk simply because they are internal. An editorial called for employee-facing systems to have authentication as strong as that of customer-facing systems, and for anomalies such as repeated connections using changing IP addresses—addresses that identify devices connected to the internet—to be detected in real time. The chair of the Financial Services Commission (금융위원회) and the governor of the Financial Supervisory Service (금융감독원) convened an emergency review meeting with financial-sector association heads and the chief executives of the financial companies affected. The effectiveness of the measures may depend on whether security reviews and monitoring also cover internal business systems.

Points that differed across reports

An editorial said that, as of October 4, personal information leaks had been confirmed at 7 institutions and attack attempts had been made against at least 9–10. A detailed report published the same day listed confirmed leaks and cases in which attacks were blocked across banks, savings banks, capital companies and mutual finance institutions. Since the reporting times and the scope of the counts may differ, these numbers should not be taken as confirming the final number of affected institutions or the full scale of the damage.

What is confirmed and what remains unknown

Confirmed facts

  • As of October 4, personal information leaks at 7 financial companies had been reported, and reports said attack attempts had been identified at a minimum of 9–10.
  • Reports said that 25,727 items of customer personal information at Shinhan Bank and the names, dates of birth, contact details and other information of about 40,000 people at Yegaram Savings Bank had been leaked.
  • Shinhan Bank’s loan-counselor lookup service, KB Kookmin Bank’s employee mobile business-support system and Hana Bank’s employee sales-support system were identified as attack routes.
  • The financial sector said that the attacked systems were separate channels from financial transaction systems, and that transaction information such as account numbers had not been leaked.
  • On October 4, the chair of the Financial Services Commission and the governor of the Financial Supervisory Service held an emergency review meeting with financial-sector representatives and the chief executives of the affected financial companies.

What remains unknown

  • The identity of those behind the hacks has not been confirmed.
  • It has not been confirmed whether ARTEX AI was actually used in the attacks.
  • The final number of financial companies affected and the total volume of personal information leaked are not yet known.
  • The reports provided do not establish whether the leaked information has actually been used for phishing or voice phishing.

What readers should check

  • If you receive a notice from a financial company about a personal information leak, check what types of information were exposed and what preventive steps the notice recommends, and determine whether the incident applies to you.
  • Even if a call or text seems to know details about your loan or financial transactions, do not assume it is genuinely from a financial company. Before providing any personal or authentication information requested, verify the contact through the company’s official channels.
  • Since financial companies have said they will fully compensate customers for losses caused by the leaks, check the procedures for reporting losses and the compensation terms in the notice.

References