KB Kookmin Bank said on Oct. 2 that the personal and credit information of 119 customers had leaked from a mobile work-support system used by employees. The exposed items included names, phone numbers, addresses and encrypted resident registration numbers.
KB said the breach was unrelated to customer financial transactions such as internet and mobile banking, and that it would fully compensate any losses. The bank blocked the server and access route immediately after recognizing on the night of Sept. 30 the possibility that information had been leaked through abnormal external access.
At Hana Bank, the personal information of 89 customers leaked through an external hacking attempt. "An external hacking agent gained abnormal access to our operations support system (ODS)," Hana Bank said. "We believe resident registration numbers, names, addresses, email addresses, phone numbers, mobile numbers and employer names were leaked."
Hana Bank blocked the servers and access routes where signs of intrusion were confirmed and said it would fully compensate customers if actual damage occurs.
In the earlier Shinhan Bank hacking incident, which exposed the information of about 25,000 customers, traces of an artificial intelligence-based automation tool were found. Moon Jong-hyun, head of the Genians Security Center, said on LinkedIn that "the string 'ARTEX-自主渗透試控制台' was identified in some HTML titles of the web server presumed to have been used in the attack," adding that "many threat analysts reasonably suspect that an AI-based attack automation tool was used in this attack."
"ARTEX AI" is a Chinese-language system that automates vulnerability scanning and attack-path design, and is available as open source. It was presented this year as the winning project in an "Agent+" offensive-defensive capability challenge led by China's Baidu. A senior financial industry official said, "It appears highly likely that ARTEX AI was used in the attack on Shinhan Bank," stressing that "we need to look into the background of such a concentrated attack."
That was not all. External hacking attempts were also made on Woori Bank and NH NongHyup Bank, but were successfully defended. In Woori Bank's case, attack attempts occurred from Sept. 29 through Oct. 1. At Busan Bank, an external hacking attempt using an AI agent took place at 9 p.m. on Oct. 1, but the main attacks were blocked. However, signs were confirmed that the personal information of 11 outsourced development workers was exposed through some web pages.
In response, the National Police Agency's cyber terror response investigation unit on the same day launched a pre-charge investigation into the string of data leaks at Shinhan, KB Kookmin, Hana and Busan banks.
Experts warn that South Korea's financial sector is exposed to hacking attacks that use AI agents. Lee Sang-geun, a professor in the school of smart security at Korea University's Graduate School of Information Security, said, "It is difficult to conclude that this incident was the work of a particular country," but added that "despite efforts by the government and the financial sector to counter AI security threats, AI technology and attacks using it are advancing far faster than expected."
What stands out is that the hacking attempts were concentrated in a specific period. That has led to speculation within the industry that the same group may be behind them. Son Kyu-sik, a professor of hacking and security at Hanyang Cyber University, said, "A significant portion of the work of preparing and operating attack tools can now be automated through AI," adding that "systems connected to the external internet with relatively weak authentication procedures can be exposed to such attacks."
Meanwhile, Shinhan Bank failed to prevent the leak despite receiving perfect scores for five consecutive years in inspections of personal credit information protection. It received an S grade (100 points) for five straight years in the Financial Services Commission's "personal credit information management and protection inspection," and holds domestic and international certifications including ISMS, ISMS-P and ISO27001.
The bank also conducted regular inspections of loan brokerage firms. Last year, while reviewing the security of companies entrusted with personal data processing, Shinhan Bank focused on high-risk sectors such as loan brokerage firms. Still, access that bypassed authentication in a simplified inquiry service for loan brokers exposed the information of about 25,000 customers. That has raised questions about whether there are flaws in the overall evaluation system.
