Externally connected systems emerge as weak points outside core banking networks as AI involvement and a common threat actor remain under investigation
On October 3, financial authorities in Seoul stepped up their response to a series of cyber intrusions and personal data leaks that have spread from South Korea’s major banks to savings banks and consumer finance companies. But the more important question is not how many financial institutions have been affected. It is where the attackers chose to strike.
Incidents disclosed so far point not to core transaction systems such as internet or mobile banking, but to peripheral systems connected to the internet, including employee support platforms, loan-recruitment services and third-party solutions. Rather than directly confronting the most heavily protected parts of the banking infrastructure, attackers appear to have sought weaker points around the edges.
Financial authorities are moving quickly. On October 4, the Financial Services Commission (FSC) will convene an emergency meeting at the Government Complex Seoul with representatives from across the financial sector, including banking, securities, insurance, credit finance, savings banks, mutual finance, virtual assets and fintech, as well as executives from financial institutions affected by security incidents. The FSC had initially planned to receive the results of financial companies’ internal security inspections on October 7, but brought the meeting forward after additional incidents were identified at a savings bank and a capital company.
The Government Complex Seoul in Jongno-gu, Seoul, which houses the Financial Services Commission. Financial authorities are conducting an industry-wide security review following a series of cyber intrusions targeting South Korean financial institutions. / Courtesy of Financial Services Commission
The scale of confirmed exposure is already significant. Shinhan Bank reported a leak involving information on about 25,000 customers, while KB Kookmin Bank identified exposure involving 119 customers and Hana Bank 89 customers. At BNK Busan Bank, no customer data leak has been confirmed, although personal information belonging to 11 outsourced developers was found to have been exposed.
Woori Bank and NH NongHyup Bank also detected external intrusion attempts, but blocked them, with no data leak confirmed so far. Beyond the major banks, Yegaram Savings Bank identified a potential leak involving information on an estimated 40,000 customers, while Hyundai Capital confirmed the exposure of some personal information belonging to 146 mortgage loan recruiters.
There is still no evidence that all of these incidents were carried out by a single threat actor. Investigators have yet to determine whether one group targeted multiple financial institutions or whether separate incidents surfaced at roughly the same time as the industry intensified its security inspections.
Attackers Found a Route Outside the Core Banking Network
The most important feature of these incidents is the type of systems in which vulnerabilities and exposures have been identified.
For years, financial institutions have invested heavily in protecting core transaction systems such as internet and mobile banking through network separation, strong authentication and access controls. Those defenses remain essential. So far, there has been no confirmation that the core financial transaction systems themselves were directly compromised in the latest incidents.
The problem lies beyond that core.
As financial services have become increasingly digital, the number of connections surrounding core banking infrastructure has continued to grow. Employee mobile platforms, loan-recruiter portals, third-party software, application programming interfaces (APIs), and systems operated by contractors and business partners can all provide routes to customer information or internal data.
Attackers do not need to confront the most heavily defended system. If they can reach sensitive information through a less protected application or service, that becomes the easier target.
That is why the FSC, at an emergency response meeting on October 2, instructed financial institutions to identify all IT assets and services accessible from outside their networks. Companies were told to review authentication and access controls regardless of whether a system was designed for customers or internal operations, and to minimize unnecessary exposure of information.
Authorities also called for rapid sharing of malicious IP addresses, attack techniques and attempted intrusion data among financial companies and relevant agencies. The move reflects a growing recognition that individual institutions acting alone may struggle to respond quickly enough to rapidly evolving cyber threats.
The Bigger Issue Is Attack Automation, Not the ‘AI Hacking’ Label
The possibility that artificial intelligence may have played a role in the attacks has also drawn attention.
A server believed to be associated with the attack on Shinhan Bank reportedly contained traces linked to a Chinese-language AI-based autonomous penetration-testing environment. Security industry experts have raised the possibility of a connection to an open-source autonomous penetration-testing tool known as ARTEX AI. Such tools can use large language models and multi-agent technologies to automate tasks including reconnaissance, vulnerability discovery, attack-path planning and security-tool execution.
But evidence of such an environment is not the same as proof that AI was actually used to carry out the attack. It has not been confirmed that ARTEX AI was deployed in the Shinhan incident, nor has it been established that the attacks against multiple financial institutions came from the same threat actor.
It is therefore premature to describe the incidents as an “AI attack on the financial sector.”
The more important issue is what AI could enable attackers to do next.
Systems and vulnerabilities that previously required significant manual effort to discover could increasingly be scanned by AI agents. If those agents can also help map attack paths and automate parts of the exploitation process, the time and resources needed to mount attacks could fall substantially.
A financial institution has to defend thousands of systems. An attacker needs to find only one weak point. If AI accelerates that search, financial cybersecurity will have to detect and close vulnerabilities much faster than before.
Financial Security Must Expand Beyond the Core Network
The incidents raise a fundamental question about what financial institutions should consider a critical security asset.
Strong protection of core banking networks remains indispensable. But a secure core network no longer means that the entire institution is secure. If an employee application, an old lookup page or a third-party solution is connected to customer information or internal data, it too becomes an entry point from an attacker’s perspective.
The FSC’s demand that financial institutions identify all externally exposed IT assets reflects this changing reality. Financial firms will increasingly need to manage their entire digital attack surface through measures such as Attack Surface Management (ASM), multi-factor authentication, least-privilege access, detection of abnormal bulk queries and stronger API controls. Contractors, business partners and third-party solutions also need to be brought within the same security framework.
The latest incidents are forcing South Korea’s financial sector to reconsider what financial security actually means. Banks do not only have to protect their core networks. A single weak employee system or internet-connected loan portal can be enough for sensitive information to escape.
Attackers do not fight the strongest door. They look for the weakest one. The task for financial institutions now is to find and close that weakness before the attackers do.
