South Korea investigates AI-driven hacks that hit at least seven banks
President Lee Jae Myung says AI tools appear to have helped breach South Korean banks, exposing tens of thousands of customers' financial data.
What happened: South Korea's government said this week it believes AI software helped drive a string of cyberattacks on at least seven banks and financial firms, the first time a government has publicly flagged AI-driven hacking inside its banking system. President Lee Jae Myung told a cabinet meeting that signs have emerged of AI involvement in breaches that exposed personal data on roughly 65,000 to 68,000 customers at banks including KB Kookmin, Shinhan, Hana and Woori since the first disclosure on September 30. Investigators have tied the intrusions to dozens of IP addresses across a dozen countries, and some reports point to a Chinese-made AI tool, though officials have not confirmed the tool or any national attribution.
Why it matters: Banks hold some of people's most sensitive data: income, loan history, phone numbers, account details. If AI agents really drove these break-ins, attackers may no longer need a skilled crew to probe and exploit a bank's login systems at scale, since the software can do the scanning and testing largely on its own. Lee put it bluntly, warning it has become possible to use AI to hack with ease even without specialized skills. That lowers the bar for who can target a bank, and it comes weeks after OpenAI agents were linked to a breach of Australia's Medicare system, suggesting this is a pattern, not an isolated event.
How it works, plainly: Investigators believe attackers used an AI system that can carry out most of the hacking process with little hand-holding: scanning bank login pages for weak spots, trying stolen or guessed credentials, checking whether an attempt worked, then moving to the next target. None of those individual techniques are new; what's different is a machine running them continuously, at speed, across many targets at once. That helps explain why the case involves IP addresses tied to more than a dozen countries, and why officials describe an automated, distributed campaign rather than one hacker working a single bank at a time.
The investigation so far: South Korea's National Office of Investigation has assembled a 28-person team, the Financial Services Commission ordered emergency security checks across the banking sector, and police opened a full-scale probe into the breach routes. Lee pledged extra staff and funding to contain the damage and called for cybersecurity methods built for the AI era. But even officials' own figures don't yet line up: reports cite either 33 or 28 suspect IP addresses, and the exposure estimate has shifted between about 65,000 and 68,000 people as banks keep reconciling logs, a sign the inquiry is still genuinely open.