KB Kookmin Bank: Hacking Breach Total Rises to 2,210 After Re-Verification

KB Kookmin Bank, South Korea's largest bank, said on October 26, 2026 that 2,091 more people had their data exposed in its September breach. That brings the total to 2,210, up from the 119 customers it first disclosed on October 2. MoneyToday reports the bank's statement as saying the new victims came from a "detailed re-verification" carried out with regulators. The bank said this was not a new intrusion. The new group includes 1,631 customers and 460 employees, so the 2,210 figure covers staff as well as customers. By that count, about 1,750 customers and 460 employees are affected. The bank apologized "for failing to fully grasp the scale of the incident at an early stage." The breach is part of a wider campaign against Korean financial institutions. Several outlets and vendors have linked that campaign to ARTEX, an open-source AI penetration-testing agent. No attacker has been publicly identified.

What Happened

The timeline depends on the source, and the accounts do not fully agree:

• The bank's account (via The Asia Business Daily and MoneyToday): On the night of September 30, an "abnormal external access" to the bank's employee mobile support system leaked customer data. The bank said it then cut off the affected server and access route, notified the 119 customers individually, and set up a dedicated support center.
• The parliamentary account (The Asia Business Daily, October 19): At a National Assembly Political Affairs Committee audit, Democratic Party lawmaker Kim Yong-man described an earlier timeline. He said a hacker first got into the bank's systems at 11:19 p.m. on September 27 and the bank only blocked the IP address. In the early hours of September 29, he said, a "relay attack" from a Vietnamese IP address leaked data on another 81 people. Kim argued that Kookmin was the first bank hit but was slow to recognize the breach, which let more data leak.
• Cover-up allegation: Kim also said he had received a tip that an information security executive ordered logs deleted after an internal meeting and a report to the CISO. Bank president Lee Hwanju denied ever giving an instruction to cover up the incident and said he had not been briefed on any such order. This is still an unproven allegation.

On the wider campaign, BleepingComputer reports that the Financial Services Commission (FSC) held an emergency meeting, started on-site investigations, and shared information with KISA. Reflectiz, citing Korea JoongAng Daily, reports that seven banks and lenders were breached between late September and early October. Their detection times ranged from 15 to 68 hours, and SBS reported that one attack ran for more than 40 hours. Reflectiz also reports that President Lee Jae-myung ordered a thorough investigation into data leaks at financial and public institutions.

What Was Taken

Accounts of what Kookmin lost differ:

• The bank's own disclosure (via The Asia Business Daily, MoneyToday): names, phone numbers, addresses and encrypted resident registration numbers. The bank stressed that internet and mobile banking were not involved.
• BleepingComputer, citing local media, described the initial Kookmin loss as "credit card information of 119 clients." The bank's statements do not describe it that way, so the bank's account should be preferred.

Reported victim counts:

Reports have not said whether the 81 people Kim described are part of the original 119. Across the whole campaign, ThreatBook estimates about 67,000 people were affected at seven institutions. Shinhan Bank accounts for the largest share, at about 25,000 customers according to BleepingComputer and the Korea Times. Hana Bank reported 89, per the Korea Times. Exposed data across the sector reportedly included annual income, loan limits, employers and loan-recruiter profiles. Rescana and BleepingComputer report that no payment credentials or data enabling transactions have been confirmed stolen.

The bank has promised full compensation for any damage. It plans to notify the newly identified victims individually.

Why It Matters

• The first count was wrong by a factor of about 18. The bank revised its number weeks later, after a forensic re-check. Early breach figures, including those from large regulated banks, should be treated as a minimum.
• Employees were exposed too. 460 staff records were taken. That data can feed impersonation and internal phishing.
• Secondary fraud is the main risk. Names, phone numbers and addresses, combined with income and loan data stolen elsewhere in the campaign, are enough for convincing loan-fraud and voice-phishing scams. The Korea Times quotes expert Hwang Suk-jin warning that the breaches may have been a first step toward larger follow-up attacks.
• AI-assisted attacks happened at once across banks. The Korea Times reports that ARTEX can connect to models from DeepSeek, OpenAI and Anthropic. Probing many institutions' side systems at the same time shrinks the window defenders have to respond.
• Governance is under scrutiny. The log-deletion allegation, even though it is denied, means incident-response records are now a matter for regulators and parliament.

The Attack Technique

The bank has confirmed only that the entry point was its employee mobile support system, which is separate from core banking.

Third-party analysis of the wider campaign gives more detail. Much of it has not been confirmed by authorities:

• ARTEX link: BleepingComputer, citing Yonhap, reports that a server used in the attacks had an HTML page title containing a Chinese-language string associated with ARTEX AI. Reflectiz reports that CrowdStrike tied attacks on two unnamed banks to ARTEX operated by a human. It is not confirmed whether Kookmin was one of them.
• Methods: ThreatBook says attackers used ARTEX with LLM-assisted reconnaissance. Their targets were authentication and access-control gaps in loan-broker lookup services, employee mobile apps and customer-facing business pages. Once in, they enumerated valid records, rotated proxy IPs and collected data automatically. Reflectiz reports a bypassed phone-verification step, weak session checks, and customer numbers fed into lookup services. No CVE has been named.
• Infrastructure: Lawmaker Kim described a Vietnamese IP address used in a follow-on "relay attack" against Kookmin. That fits the proxy rotation ThreatBook describes.

Rescana reported that no public indicators of compromise were available as of October 6.

What Organizations Should Do

1. Inventory every internet-facing system, including internal tools. The FSC ordered this for all financial firms. Employee mobile portals and broker lookup tools are the entry points reported in this campaign.
2. Enforce authentication and per-object authorization on every data endpoint. Close any path to internal data that skips authentication. Make sure session tokens are checked on every request, not just at login.
3. Detect enumeration. Set alerts for repeated lookups by sequential or high-volume identifiers, and for the same session or credentials appearing from rotating IPs. Detection times of 15 to 68 hours were too slow for this campaign.
4. Treat a blocked IP as the start of an investigation. In the timeline Kim described, blocking a single IP without a full investigation let the attacker return two days later.
5. Protect and retain logs. Use immutable, centralized logging so evidence can't be deleted, whether on purpose or by accident, and so a scope can be re-verified quickly.
6. Run AI-assisted testing against your own perimeter first. Then prepare anti-fraud messaging for exposed customers and staff, since targeted phishing using leaked personal data is the most likely next step.

Sources: KB Kookmin Bank: "Additional 2,091 individuals confirmed in hacking... | South Korea probes bank breaches amid suspected AI-powered attacks | 2026 Parliamentary Audit KB Kookmin Bank Denies Allegations of Data... | 119 KB Kookmin Bank Customer Records Leaked... "Full Compensation f... | South Korea's Bank Hacks - ARTEX and Agentic Pentesting | AI-Powered Cyber Attacks Target Major South Korean Banks | EXPLAINER How AI emerged as new threat in Korea's bank hacking cris... | ARTEX Attacks on South Korean Financial Institutions