South Korea activates round-the-clock cyber emergency after AI tool breaches multiple banks

Overview

Updated 1 hour ago

South Korea's government activated a round-the-clock cybersecurity emergency Monday after an AI-powered attack tool breached seven financial institutions in a single week. The open-source tool, called ARTEX, exposed personal data of more than 65,000 customers before authorities could respond.

The breach is the first known coordinated campaign where an autonomous AI agent broke into multiple financial institutions. Regulators have ordered all financial firms to block external access to systems and are reviewing the sector's entire security framework.

Why it matters

An AI agent breached seven banks in a week, forcing regulators to re-examine every financial firm's security framework.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

Financial institutions breached

Shinhan, KB Kookmin, Hana, BNK Busan, Yegaram, Welcome Savings, and Hyundai Capital.

65,000+

Customers affected

Personal data exposed across the seven institutions. Figure expected to rise as investigations continue.

$92M

Top 3 banks' security spending last year

Shinhan, KB Kookmin, and Hana spent nearly 124 billion won on information security, yet the attacks bypassed their defenses.

Watch

National cyber alert level

Raised from 'Caution' to 'Watch' on October 5, the second-highest of five levels.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

People Involved

Lee Eog-weon

Chairman, Financial Services Commission

Leading the regulatory response to the breach

Organizations Involved

Financial Services Commission (FSC)

Government Regulatory Agency

Leading the regulatory response

South Korea's top financial regulator, responsible for overseeing the financial industry and responding to systemic threats.

Korea Internet & Security Agency

Government Agency

Operating 24-hour incident response

South Korea's internet security agency, operating the Internet Infringement Response Center that coordinates cyber incident response.

Shinhan Bank

Commercial Bank

First institution to report a breach

One of South Korea's largest commercial banks and the first institution to report a breach in the October 2026 campaign.

Timeline

4 events Latest: Today

Tap a bar to jump to that date

October 2026
Round-the-clock cyber emergency activated
Today Government Response

National cyber alert level raised from Caution to Watch. KISA places emergency deployment teams on permanent standby.
Today
FSC orders emergency security measures
Regulatory Action

Financial Services Commission convenes emergency meeting, orders financial firms to block external access to systems unless essential.
Yesterday
Ministry of Science and ICT activates emergency response
Government Response

Ministry activates 24-hour emergency response system with KISA to prevent spread of cyber threats.
Yesterday
First data leaks reported at South Korean banks
Incident

Shinhan Bank and other institutions report personal data exposure. Same attacker IP found across all seven firms.
4 days ago

Scenarios

South Korea overhauls financial security framework

Likely Resolves by End of 2026

Discussed by: Financial Services Commission, Korea Herald, Asia Business Daily

The FSC has already ordered comprehensive inspections of externally exposed IT assets and signaled regulatory changes. This scenario sees the FSC announce new security regulations, including AI-based defense systems and relaxed network separation rules, by the end of 2026. The FSC has explicitly called for an 'AI attacks defended by AI' approach.

Attacker identified through IP tracing

Possible Resolves by Q2 2027

Discussed by: Korea Herald, Korea Times

Authorities have the attacker's IP address and traces of the ARTEX tool on a server used in the campaign. The attacker is believed to be based overseas, which complicates prosecution. This scenario sees authorities formally identify or arrest the attacker through international cooperation.

Leaked data fuels voice phishing wave

Possible Resolves by End of 2026

Discussed by: Financial Services Commission, Korea Times

FSC Chairman Lee warned that exposed data could facilitate voice phishing and smishing. This scenario sees reports of phishing campaigns using the leaked data to target affected customers, prompting additional consumer protection measures from regulators.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

March 2013

2013 South Korea cyberattack (March 2013)

On March 20, 2013, a coordinated cyberattack wiped hard drives at three South Korean broadcasters and two banks, including Shinhan Bank. The malware rendered tens of thousands of computers inoperable.

Then

Banks and broadcasters restored systems over several days. South Korea blamed North Korea for the attack.

Now

The attack prompted South Korea to strengthen its national cybersecurity posture and led to the creation of the National Cyber Security Center.

Why this matters now

Like the current attack, it was a coordinated campaign targeting South Korean financial institutions, showing the sector's vulnerability to sophisticated cyber threats.

February 2016

Bangladesh Bank heist (2016)

Attackers breached Bangladesh Bank's systems and used the SWIFT messaging network to attempt transfers of nearly $1 billion. They stole $81 million before a typo halted the remaining transfers.

Then

The stolen funds were routed through Philippine casinos and largely unrecovered. The attack exposed weaknesses in SWIFT's security.

Now

It prompted global banks to strengthen SWIFT security and highlighted how attackers target financial infrastructure.

Why this matters now

It showed how a single breach of financial infrastructure can lead to large-scale losses, though the current attack appears focused on data theft rather than direct fund transfers.

May-September 2017

Equifax breach (2017)

Attackers exploited a vulnerability in Equifax's web application to access personal data of 147 million Americans, including Social Security numbers and credit card data.

Then

Equifax faced congressional hearings, a $700 million settlement, and a permanent hit to its reputation.

Now

The breach became a benchmark for data breach costs and prompted stronger data protection regulations.

Why this matters now

It shows how a single vulnerability can expose massive amounts of personal data, similar to how the ARTEX tool found weak points in South Korean banks' systems.