AI-agent-assisted intrusions breach Shinhan, KB Kookmin, Hana and 13 other Korean financial firms

What happened?

Shinhan Bank said on 1 October 2026 that personal information of about 25,000 customers had been leaked through hacking; the Korea Herald later put the count at 25,729. According to Maeil Business, the attacker queried Shinhan's mobile loan-inquiry service used by loan agents for at least 15 hours from the morning of 29 September, extracting names, phone numbers, annual income and calculated loan limits, plus 66 resident registration numbers. The Financial Supervisory Service (FSS) sent an inspection team the same day, and Yonhap reported sources as saying the hackers used advanced AI tools.[4][8][11]

Further breaches followed. KB Kookmin Bank reported data on 119 customers leaked through an employee mobile work-support system (later reported as 153 individuals), Hana Bank 89 customers through its ODS sales-support system, and BNK Busan Bank records on 11 outsourced workers. By 4 October breaches had been reported at seven firms, including Yegaram Savings Bank (about 40,000 people), Welcome Savings Bank and Hyundai Capital, with combined exposure of about 66,000 individuals and 2,200 corporate records, the Korea Herald reported. Woori Bank and NH NongHyup Bank reported blocked attempts with no data leaked.[6][7][8]

On 14 October 2026 the Financial Services Commission (FSC) said 16 companies across all financial sectors had confirmed data breaches, with about 100,000 pieces of customer data exposed, including names, contact details, resident registration numbers and email addresses. It said the FSS and the Financial Security Institute (FSI) were investigating whether the incidents were linked, came from the same attacker, and whether AI had been used. An emergency 12-point self-assessment found shortcomings at 130 of 555 financial companies.[1][10]

CrowdStrike reported that a threat actor, likely Chinese-speaking and financially motivated (moderate confidence), ran a campaign against South Korean financial organisations from late September to early October 2026 using ARTEX, a Chinese-developed open-source agentic penetration-testing tool, alongside large language models; it said the compromised systems included a bank's loan-progress inquiry service and another bank's employee mobile work-support system. An FSI official told The Herald Business that "it is true that AI was used in the attacks, but the AI did not act independently without human involvement". FSC chair Lee Eok-won said the commission could not rule out attacks using AI.[3][5][7][9]

When did it happen?

1. Sep 29, 2026

   The attacker begins extracting data from Shinhan Bank's mobile loan-inquiry service, according to Maeil Business.[11]

2. Oct 1, 2026

   Shinhan Bank discloses a leak of about 25,000 customers' data; the FSS starts an on-site inspection.[4]

3. Oct 2, 2026

   KB Kookmin, Hana and BNK Busan report breaches; the FSC convenes an emergency meeting and orders checks of externally exposed systems.[6]

4. Oct 4, 2026

   Breaches reported at seven firms; the FSC orders financial firms to block external access not essential to operations, and President Lee Jae Myung calls for a thorough investigation.[7]

5. Oct 6, 2026

   The Korean National Police Agency assigns 28 investigators to a full-scale probe; the FSC and FSS issue a consumer alert over follow-on phishing.[2][8]

6. Oct 7, 2026

   CrowdStrike reports that the attacker used the ARTEX agentic penetration-testing tool and large language models.[3][5]

7. Oct 14, 2026

   The FSC says 16 financial companies have confirmed breaches and about 100,000 pieces of customer data were exposed.[1][10]

What was the impact?

• Customers: About 100,000 pieces of customer data at 16 financial firms (FSC, 14 October 2026), including about 25,700 Shinhan Bank customers and about 40,000 Yegaram Savings Bank customers[1][2][7][8]
• Other: Exposed data included names, phone numbers, email addresses, resident registration numbers and, at Shinhan, annual income and loan limits. The FSC said no account passwords or credit card numbers were leaked and, as of 6 October, no phishing losses using the leaked data had been confirmed.[1][2][7][8]

Severity 5 of 5: Systemic and criminal: intrusions at 16 financial firms across several sectors exposed about 100,000 customer records, triggering a national police investigation, a regulator-wide emergency security review of 555 firms and a presidential call for a security overhaul.

How did Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank and Yegaram Savings Bank respond?

Shinhan Bank said it set up a response team, blocked access from external IP addresses, suspended the affected service and would compensate customers for any resulting damage. Hana Bank said the breached system was separate from internet and mobile banking, blocked the linked IP address and said it would fully compensate resulting losses; KB Kookmin said customer banking transactions were unaffected and pledged compensation.[4][6][11]

What was the outcome, and did regulators act?

As of 21 October 2026 the Korean National Police Agency's cyber-terror investigation unit is investigating, and the FSS and FSI are examining the attack vectors and whether AI was used. The FSC has instructed affected firms to block the attacker's IP addresses and patch systems, ordered help desks and stronger fraud monitoring during a one-month special response period, and announced an exhaustive inspection of financial companies' cybersecurity, faster threat sharing, more frequent mandatory vulnerability testing and support for smaller firms against AI-driven risks. No penalties had been announced.[1][2][8]

1. Authorities Hold Meeting on Cybersecurity Management in Financial Sector to Bolster Anti-Hacking Measures official
   Financial Services Commission (Korea) · Oct 14, 2026
   “At the time of this meeting, 16 companies in total have been confirmed to have experienced data breach incidents recently across all financial sectors. The extent of data breaches is estimated to be about 100,000 pieces of customer data (names, contact information, resident registration numbers, email addresses, etc.).”
2. FSC-FSS Issue Consumer Alert over Potential Phishing Scams Following Data Breaches in Financial Sector official
   Financial Services Commission (Korea) · Oct 6, 2026
   “So far, there have been no confirmed cases of phishing scams resulting in financial damage or money being stolen with leaked consumer data.”
3. Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance security research
   CrowdStrike · Oct 7, 2026
   “In this activity, the threat actor leveraged ARTEX, a recently released open-source agentic penetration testing (pentesting) tool developed in China, alongside large language models (LLMs).”
4. (LEAD) Some 25,000 customers' info leaked from Shinhan Bank in apparent AI agent-assisted hacking news
   Yonhap · Oct 1, 2026
   “Sources said the hackers, currently suspected to be based overseas, utilized advanced artificial intelligence (AI) tools in the attacks.”
5. Chinese-speaking hacker possibly linked to AI-driven attacks on S. Korean banks: report news
   Yonhap · Oct 8, 2026
   “The findings come amid a series of data breaches at South Korean financial institutions, including Hana Bank, KB Kookmin Bank and Shinhan Bank, prompting financial authorities and investigators to launch probes into the incidents.”
6. Hana, BNK report data breaches as hacking hits Korean banks news
   The Korea Herald · Oct 2, 2026
   “Neither the bank nor the financial authorities have officially confirmed whether the tool was used in the breach, according to local reports.”
7. Korean banks on high alert after wave of cyberattacks news
   The Korea Herald · Oct 5, 2026
   “"We cannot rule out the possibility of attacks using AI," FSC Chair Lee Eok-won said, urging the sector to maintain the highest level of vigilance.”
8. Police launch major probe as suspected AI hacks sweep through banks news
   The Korea Herald · Oct 6, 2026
   “South Korean police launched a full-scale investigation Tuesday into a series of suspected AI-assisted hacking attacks on financial institutions that exposed the personal information of tens of thousands of people.”
9. Exclusive: Chinese AI tool ARTEX used in wave of bank hacks, probe finds news
   The Herald Business · Oct 3, 2026
   “"It is true that AI was used in the attacks, but the AI did not act independently without human involvement," the official said. "A hacker used the AI as a tool."”
10. Korea finds 16 financial firms breached, 100,000 records leaked news
    Aju Press · Oct 14, 2026
    “The affected firms include Shinhan Bank, KB Kookmin Bank, BNK Busan Bank and Hana Bank, along with four savings banks and companies in other financial sectors.”
11. It has been confirmed that a series of hacking attacks targeting the domestic financial sector have caused infringement accidents at 16 financial companies (machine-translated headline) news
    Maeil Business · Oct 15, 2026
    “Shinhan Bank was found to have stolen customer information for at least 15 hours from the morning of September 29 to the dawn of the 30th.”