South Korea activates round-the-clock cyber emergency after AI tool breaches multiple banks
New Capabilities
An open-source AI tool exposed about 100,000 personal records across 16 South Korean financial firms, and depositors pulled more than 20 trillion won from the biggest banks
South Korea's cyber alert remains at Watch, the second-highest of five levels, after regulators confirmed on October 14 that breaches at 16 financial firms exposed about 100,000 personal records. That is up from seven firms and about 68,000 people reported earlier in the month. Depositors pulled more than 20 trillion won from the five biggest banks between September 30 and October 11.
On October 19, the heads of the five largest banks apologized at a National Assembly audit, and the Financial Supervisory Service promised stronger cybersecurity. Police added a charge under the Electronic Financial Transactions Act on October 20 and sent the case to the Serious Crime Investigation Agency. Japanese researchers also found the same ARTEX tool on servers used against about 80 Japanese insurers, financial firms and logistics companies.
Why it matters
One person used a free AI tool to steal data from 68,000 bank customers in South Korea, triggering a deposit flight and a nationwide security review.
Questions about this story
Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.
No questions yet — be the first to ask.
Key Indicators
100,000
Personal records exposed
Customers and employees at 16 banks, savings banks, insurers and other financial firms. Leaked items included names, contact numbers, resident registration numbers and email addresses. Count as of October 14.
20T+ won
Deposits pulled from five biggest banks
Deposits fell from 675.5 trillion won on September 30 to 655.4 trillion won by October 11, about 3%, as customers moved money after the breaches.
28
Attacker IP addresses identified
Traced to 12 countries, including the US, Japan, Hong Kong, and Singapore. Police say most were used to conceal the attacker's actual traces.
16
Financial institutions with confirmed breaches
Shinhan, KB Kookmin, Hana, BNK Busan, Yegaram, Welcome Savings, Hyundai Capital, DB Savings Bank, KDB Capital, Streami and others. Regulators confirmed the total on October 14.
130
Firms with security shortcomings
Of 555 financial firms that completed a self-checklist by October 8, 130 reported shortcomings such as missing security patches and weak access controls.
Watch
National cyber alert level
Raised from 'Caution' to 'Watch' on October 5, the second-highest of five levels.
YY520CN
Suspect account under investigation
Reuters reported investigators were looking into a 26-year-old in Guangdong, China, who uses this username. The person denied involvement; attribution rests on moderate confidence.
The National Office of Investigation added a violation of the Electronic Financial Transactions Act to the existing Information and Communications Network Act charge. It said it would notify the Serious Crime Investigation Agency, which handles serious crimes.
ARTEX linked to attacks on about 80 Japanese firms
International
GMO Internet Group's security unit found traces of ARTEX on six overseas servers used in attacks on about 80 Japanese insurers, financial firms and logistics companies between September 18 and October 18. The tool's developer, Li Fuhua, has announced a commercial version called RedAgent.ai.
Bank chiefs apologize at National Assembly audit
Government Response
The heads of the five largest banks apologized for the breaches and pledged AI-based defenses at a National Assembly audit. The Financial Supervisory Service chief said regulators would push institutions to invest more in security and staff.
Regulators confirm 16 firms and about 100,000 leaked records
Regulatory Action
The Financial Services Commission and Financial Supervisory Service said breaches had been confirmed at 16 banks, savings banks, insurers and other financial firms. About 100,000 records were exposed, and 130 of 555 firms checked reported security shortcomings.
Depositors pull 20 trillion won from biggest banks
Market Impact
Deposits at the five biggest banks fell from 675.5 trillion won on September 30 to 655.4 trillion won by October 11, about 3%, as customers moved funds after the breaches. The banks raised security budgets to buy AI defenses.
Security agency had briefed banks on such AI attacks weeks earlier
Investigation
The Korea Financial Security Institute had walked bank security staff through a similar AI attack on a domestic lender weeks before the breaches began in late September, per documents the agency gave a lawmaker. An FSI official said the attacks were not fully automated — a hacker used the AI as a tool.
Reuters names suspect account YY520CN
Investigation
Reuters reported investigators were looking into a 26-year-old in Guangdong, China, who operates under the username YY520CN. The suspect denied involvement. CrowdStrike's attribution is moderate confidence; the operator left the attack sessions open, which is how they were found.
FSC orders bank-wide checks on externally exposed systems
Regulatory Action
Secretary general Shin Jin-chang led an emergency meeting that ordered lenders and card companies to map every IT asset reachable from outside their networks, cut what is visible externally, and enforce authentication on any path to internal data. Regulators opened on-site inspections at affected banks.
Reports point to possible suspect in China
Investigation
Reuters described the suspect as a likely 26-year-old in Guangdong, China, operating as YY520CN. CrowdStrike traced the lead to a Claude Code session in which the operator asked the AI to draft a resume and asked where to sell stolen Korean bank data, but said available information could not definitively link those details to the attacker.
ARTEX developer closes project source code
Industry Response
The developer of ARTEX, who goes by Autumn-27 on GitHub, converted the project to closed source and halted further releases. The developer said ARTEX 'was originally designed for the purpose of learning and research.'
FSC chairman admits inadequate response at parliamentary audit
Government Response
Financial Services Commission Chairman Lee Eog-weon told a parliamentary audit that the government's early response to AI-assisted cyberattacks had been inadequate. He said the government is considering easing network separation rules to let banks use AI for defense.
National Assembly approves summoning bank heads for audit
Government Response
The National Assembly's Policy Affairs Committee approved a plan to summon the heads of five major commercial banks as witnesses for the Financial Supervisory Service parliamentary audit on October 19.
Law firm prepares damages lawsuit for Shinhan customers
Legal
A South Korean law firm began recruiting affected Shinhan Bank customers for a damages lawsuit, seeking between 100,000 and 300,000 won per participant.
Police open formal investigation into bank cyberattacks
Legal
The National Police Agency's National Office of Investigation booked the case on charges of violating the Information and Communications Network Act and assigned 28 investigators across four teams.
FSS identifies 28 attacker IP addresses, shares with financial firms
Investigation
The Financial Supervisory Service traced 28 distinct IP addresses across 12 countries and distributed them to financial companies, asking them to complete security checks by October 8.
Ministry of Science and ICT and KISA mobilize round-the-clock response
Government Response
KISA strengthened its Internet Infringement Response Center, placed emergency teams on standby, and used the C-TAS platform to share threat intelligence with about 28,000 companies.
Round-the-clock cyber emergency activated
Government Response
National cyber alert level raised from Caution to Watch. KISA places emergency deployment teams on permanent standby.
FSC orders emergency security measures
Regulatory Action
Financial Services Commission convenes emergency meeting, orders financial firms to block external access to systems unless essential.
Ministry of Science and ICT activates emergency response
Government Response
Ministry activates 24-hour emergency response system with KISA to prevent spread of cyber threats.
First data leaks reported at South Korean banks
Incident
Shinhan Bank and other institutions report personal data exposure. Same attacker IP found across all seven firms.
Scenarios
1
South Korea overhauls financial security framework
Likely
Resolves by End of 2026
Discussed by: Financial Services Commission, Korea Herald, Asia Business Daily
The FSC has already ordered comprehensive inspections of externally exposed IT assets and signaled regulatory changes. This scenario sees the FSC announce new security regulations, including AI-based defense systems and relaxed network separation rules, by the end of 2026. The FSC has explicitly called for an 'AI attacks defended by AI' approach.
2
Attacker identified through IP tracing
Possible
Resolves by Q2 2027
Discussed by: Korea Herald, Korea Times
Authorities have the attacker's IP address and traces of the ARTEX tool on a server used in the campaign. The attacker is believed to be based overseas, which complicates prosecution. This scenario sees authorities formally identify or arrest the attacker through international cooperation.
3
Leaked data fuels voice phishing wave
Possible
Resolves by End of 2026
Discussed by: Financial Services Commission, Korea Times
FSC Chairman Lee warned that exposed data could facilitate voice phishing and smishing. This scenario sees reports of phishing campaigns using the leaked data to target affected customers, prompting additional consumer protection measures from regulators.
4
Class-action lawsuits mount against affected banks
Possible
Resolves by End of 2026
Discussed by: Aju Press, legal observers
A law firm has begun recruiting affected customers for a damages suit against Shinhan Bank, with per-person claims of 100,000-300,000 won. Additional suits against the other six firms are plausible if the initial case gains traction.
5
Parliamentary audit forces bank accountability measures
Deadline passed (Oct 19, 2026)
Discussed by: National Assembly Policy Affairs Committee, Korea Times
The National Assembly approved summoning the heads of five major banks as witnesses for the Financial Supervisory Service audit on October 19. This scenario sees the audit produce concrete accountability measures, such as fines, leadership changes, or new security mandates for the affected banks.
6
Deposit flight pressures banks and regulators
Possible
Resolves by End of 2026
Discussed by: AGI Watch, South Korean financial press
Depositors pulled more than 20 trillion won from the five biggest banks in eleven days after the breaches. If outflows continue, regulators face pressure to guarantee deposits or speed the shift to AI-based defenses, and banks may raise security budgets further.
Historical Context
3 moments from history that rhyme with this story — and how they unfolded.
1 of 3
March 2013
2013 South Korea cyberattack (March 2013)
On March 20, 2013, a coordinated cyberattack wiped hard drives at three South Korean broadcasters and two banks, including Shinhan Bank. The malware rendered tens of thousands of computers inoperable.
Then
Banks and broadcasters restored systems over several days. South Korea blamed North Korea for the attack.
Now
The attack prompted South Korea to strengthen its national cybersecurity posture and led to the creation of the National Cyber Security Center.
Why this matters now
Like the current attack, it was a coordinated campaign targeting South Korean financial institutions, showing the sector's vulnerability to sophisticated cyber threats.
2 of 3
February 2016
Bangladesh Bank heist (2016)
Attackers breached Bangladesh Bank's systems and used the SWIFT messaging network to attempt transfers of nearly $1 billion. They stole $81 million before a typo halted the remaining transfers.
Then
The stolen funds were routed through Philippine casinos and largely unrecovered. The attack exposed weaknesses in SWIFT's security.
Now
It prompted global banks to strengthen SWIFT security and highlighted how attackers target financial infrastructure.
Why this matters now
It showed how a single breach of financial infrastructure can lead to large-scale losses, though the current attack appears focused on data theft rather than direct fund transfers.
3 of 3
May-September 2017
Equifax breach (2017)
Attackers exploited a vulnerability in Equifax's web application to access personal data of 147 million Americans, including Social Security numbers and credit card data.
Then
Equifax faced congressional hearings, a $700 million settlement, and a permanent hit to its reputation.
Now
The breach became a benchmark for data breach costs and prompted stronger data protection regulations.
Why this matters now
It shows how a single vulnerability can expose massive amounts of personal data, similar to how the ARTEX tool found weak points in South Korean banks' systems.
