Hana Bank

On October 4th, the bank reported that information belonging to around 25,000 customers had been exposed.

And it was followed by KB Kungmin Bank reporting a breach affecting 119 customers and Hana Bank reported 89.

Then these attacks spread beyond major commercial banks to savings banks and other financial companies such as Yegaram Savings Bank and Hyundai Capital.

And as of this week, as of Wednesday, according to the Financial Services Commission, the number of firms affected by these attacks was 16.

South Korean bank attack campaign we've been following all week now has a clearer picture, and it's a useful one for understanding where AI-powered offensive operations stand right now.

CrowdStrike confirming the cyber attacks against Shinhan Bank, KB, uh, Kookmin Bank, and Hana Bank were launched by a single Chinese-speaking threat actor using Artex AI until recently, an open source agentic penetration testing suite built in China and multiple cloud code sessions as the primary agent framework.

The attacker's operational security failed in a revealing way, open directories on their infrastructure, exposed cloud code session histories, um, and revealing, um, Artex configuration files and cloud memory files, which CrowdStrike used to confirm both the tool chain and the target overlap with prior reporting.

The Artex instance ran DeepSeek version 4.1, uh, dash Flash as the primary model back end, with GLM 5.3 from Zhipu AI and Grok 4.6 supplementing it for additional cloud code sessions, routed through what appeared to be an LLM API proxy at xkai.pro. Those session files also contained a personal resume created using the same AI tools that puts the attacker as a potential twenty-six-year-old from Guangdong province who studied at the South China University of Technology.

Uh, authorities have found thirty-three IP addresses used in the hacks, and they are correlating information about them now.

Uh, investigation is ongoing, but some of the banks mentioned are Hana Bank, KB Kookmin, Shinhan among them.

Uh, Shinhan alone had twenty-five thousand customers', uh, data compromised.

Uh, this include...

President Lee Jae-myung stated that signs have emerged pointing to the use of AI models in the cyber attacks, causing considerable public concern and anxiety.

The National Office of Investigation is looking into breaches at Hana Bank, KB Cookmin and Shinhan Bank.

Shinhan Bank reported that the personal credit information of roughly 25,000 people had been leaked.

The attacks highlight a growing global alarm over the fast-evolving capabilities of AI agents and whether current cybersecurity and legal frameworks are equipped to handle them.

Officials confirmed a breach at Shinhan Bank and other incidents involving Kookmin Bank.

Hana Bank also reported a limited compromise of a sales support system.

Local reports put the affected totals at 25,000 Shinhan customers and 119,000 Kookmin credit card clients.

Authorities have launched on-site investigations and told financial companies to strengthen monitoring and incident reporting.

Shinhan Bank lost data on about twenty-five thousand seven hundred people, including names, phone numbers, income, and credit limits through a service that loan brokers use to check on applications, apparently by guessing customer numbers over and over.

KB Kookmin and Hana Bank lost smaller amounts through staff work systems, and savings banks and a consumer lender were hit, too.

The online banking and mobile apps that customers use held up.

The attacker went for the side doors instead, meaning partner portals and employee tools that had been looked after less carefully.

Here's another example.

Hana Bank issues South Korea's first digital bond using Euroclear's blockchain.

So this is South Korea's second largest bank and their $100 million foreign currency bond blockchain issuance shortened settlement time to the same day from three to five business days.

So we've talked a lot about it.