South Korea's Financial Services Commission (FSC) confirmed five more breached financial firms on October 14: DB Savings Bank, KDB Capital, electronic financial service provider Brightfix, and virtual asset service providers Streami (operator of the GOPAX exchange) and Prabang. That brings the regulator's tally to 16 firms, up from 11, according to Chosun Biz and the Seoul Economic Daily. Both outlets report that regulators have so far identified about 100,000 leaked personal information records. The wave began in late September at Shinhan Bank, KB Kookmin Bank and Hana Bank. CrowdStrike has since linked at least the early intrusions to a likely Chinese-speaking, financially motivated actor. That actor used ARTEX, a Chinese-developed open-source agentic penetration testing tool, together with commercial large language models. The "16" is the regulators' count of breached firms. It does not mean all 16 incidents have been attributed to one actor, and the newest cases point to more than one technique.
What Happened
Phase one: the big banks (late September to early October). On October 2, Shinhan, KB Kookmin and Hana disclosed breaches in systems used by employees, loan brokers and sales staff, not in their core internet or mobile banking platforms (Korea Times). Police opened a preliminary inquiry covering those three banks plus BNK Busan Bank. Within days, BBC Korea reported confirmed damage at Yegaram Savings Bank, Hyundai Capital and Welcome Savings Bank. It also reported intrusion attempts against Saemaul Geumgo (KFCC) and NongHyup's mutual finance arm, with no leak confirmed at that point.
Regulatory escalation. The FSC moved its planned October 7 review meeting forward to October 4. FSC Chairman Lee Eok-won and Financial Supervisory Service (FSS) Governor Lee Chan-jin called in industry association heads and the CEOs of affected firms. Chairman Lee said AI-assisted attacks "cannot be ruled out," and President Lee Jae-myung ordered a thorough investigation (BBC Korea, BleepingComputer). Regulators sent on-site investigators and shared attacker IP addresses and intrusion methods with the sector and with KISA.
Phase two: spread to smaller firms (October 10 to 14). SBS reports that KFCC was breached after 2:00 PM on October 10 through a web page used by mutual aid insurance customers. KFCC detected the breach on October 12. OK Savings Bank detected an attack on a loan application web page on October 12. On October 14, the FSC, FSS and Financial Security Institute held a second emergency meeting, chaired by FSC Secretary General Shin Jin-chang, and announced the five additional victims (Seoul Economic Daily).
The FSC's current breakdown of the 16 firms, as reported by Chosun Biz:
- Banks (4): Shinhan, KB Kookmin, Busan, Hana
- Savings banks (4): Yegaram, Welcome, DB, OK
- Specialized credit finance (2): Hyundai Capital, KDB Capital
- Online investment-linked finance (2): PFCT, MOUDA
- Electronic financial services (1): Brightfix
- Virtual asset service providers (2): Streami (GOPAX), Prabang
- Mutual finance (1): KFCC (Saemaul Geumgo)
A caveat on "confirmed breach." DB Savings Bank is listed as a breached firm, but it says there are no signs that personal information leaked (Chosun Biz). A firm on the list may have suffered unauthorized access without confirmed data loss.
What Was Taken
Regulators put the total at about 100,000 records (Chosun Biz, Seoul Economic Daily). The per-firm figures published so far add up to well under that, so part of the total has not yet been broken down publicly.
- Shinhan Bank: the largest single incident. BBC Korea reports 25,729 customers. The Korea Times and BleepingComputer give about 25,000. Data included names, mobile numbers, annual income, loan limits, products applied for and interest rates.
- Yegaram Savings Bank: about 40,000 customers (estimated), including names, dates of birth and contact details (BBC Korea).
- Welcome Savings Bank: up to about 2,200 corporate client records, including company names, contact names, emails and phone numbers (BBC Korea).
- KFCC (Saemaul Geumgo): about 400 customers across 12 data categories, including names, phone numbers, addresses, encrypted resident registration numbers, account numbers and balances (SBS).
- OK Savings Bank: a potential leak affecting 180 people (SBS).
- Hyundai Capital: 146 mortgage loan recruiters (BBC Korea).
- KB Kookmin Bank: 119 customers. Accounts differ on what was taken. The Korea Times and BBC Korea describe personal information. BleepingComputer reports credit card information. Treat the card data claim as unconfirmed until the bank or a regulator states it.
- Hana Bank: 89 customers, including resident registration numbers, names, addresses, emails, phone numbers and employers (BBC Korea).
- BNK Busan Bank: 11 outsourced developers' names, phone numbers, dates of birth and emails (BBC Korea).
- GOPAX: fewer than 10 customer accounts accessed abnormally, with no asset loss, according to the exchange (Chosun Biz).
The banks say no customer transaction data was exposed (Korea Times). Even so, resident registration numbers combined with income, loan limits and account balances are very useful for targeted financial fraud and voice phishing.
Why It Matters
This is one of the first documented cases of an agentic AI pentesting framework used operationally against a national financial sector. CrowdStrike found the threat actor's open directories, which held Claude Code session histories, ARTEX configuration files and Claude memory files. These gave a direct view of an AI-orchestrated intrusion workflow. According to BleepingComputer's coverage of CrowdStrike's findings, the actor had no specific plan and worked opportunistically. The concern is not a novel exploit. It is that an actor with modest skill can automate reconnaissance and exploitation across many targets' exposed web services at once.
The targeting matters as much as the tooling. Not one of the confirmed bank intrusions hit core banking. Every one went through peripheral systems: broker portals, employee mobile apps, sales-support tools, recruiter lookup pages and insurance customer pages. These systems are often less hardened, sit outside the main security perimeter, and still query production customer data.
The scale of exposure is also clear. The Seoul Economic Daily reports that 130 financial firms reported security gaps during the regulator-ordered self-inspections. Regulators will now require large firms to run vulnerability checks at least twice a year and plan AI-based joint security services for smaller firms.
Analysts should not treat all 16 incidents as one actor's work. CrowdStrike's report, dated October 7, covers activity from late September to early October and states the number of affected organizations was unconfirmed. The KFCC intrusion reportedly came from an IP address outside the 28 addresses tied to earlier attacks (SBS). The GOPAX incident was credential stuffing with previously leaked IDs and passwords (Chosun Biz), a different and far more common technique. Possible explanations include copycat activity, a second actor, or infrastructure rotation. The sources do not settle which.
The Attack Technique
Initial access. In the bank incidents the attacker went after internet-facing business-support applications. At Shinhan, an unauthorized party bypassed authentication on a service loan agents use to check application status (Korea Times). KB Kookmin's employee mobile work-support system and Hana's sales-support system (ODS) were also compromised (BBC Korea). Hyundai Capital leaked data through a mortgage recruiter lookup page. Regulators told firms to check for "missing or inadequate authentication and access controls" (BleepingComputer). That points to broken access control and exposed data endpoints, not memory-corruption exploits.
Tooling. CrowdStrike (PRIMARY) identified ARTEX running on attacker-controlled infrastructure at 38.244.50[.]120. Yonhap first reported a Chinese-language HTML page title linked to ARTEX on an attack server (via BleepingComputer). CrowdStrike says the ARTEX instance used DeepSeek v4.1-flash as its main LLM backend. The actor added GLM-5.3 (Zhipu AI) and Grok 4.6 in further Claude Code sessions. CrowdStrike assesses that the actor likely reached DeepSeek through the probable LLM API proxy or reseller xcai[.]pro (BleepingComputer).
Attribution. CrowdStrike assesses with moderate confidence that the actor is likely a Chinese speaker and financially motivated. The assessment rests on the use of ARTEX and on Chinese-language prompts. CrowdStrike has not tied the activity to a named adversary. BleepingComputer reports that the actor also used the AI tools to write a résumé, which exposed identity and Telegram details. CrowdStrike cautions that inconsistencies in that material, including conflicting birth dates, make it too unreliable to confirm identity.
Impact beyond data theft. BleepingComputer reports system outages at some targets. KFCC suspended its insurance app and web services as a precaution (SBS).
What Organizations Should Do
- List and test every externally reachable application, not just customer-facing ones. Broker portals, partner lookup pages, employee mobile apps and sales tools were the entry points here. Regulators explicitly ordered firms to inspect non-customer-facing external systems.
- Enforce server-side authentication and authorization on every data endpoint. Test for authentication bypass, IDOR and unauthenticated API routes behind "internal" front ends. Automated agentic scanners find these quickly.
- Minimize data returned by peripheral systems. A loan-status checker should not return income, loan limits and resident registration numbers in bulk. Mask fields, limit response sizes and rate-limit lookups per session and per account.
- Hunt for the published indicators and for automated probing patterns. Block and search logs for 38.244.50[.]120 and the regulator-shared IP list. Also look for fast, systematic enumeration of web parameters, since new infrastructure has already appeared.
- Harden against credential stuffing. As the GOPAX case shows, opportunistic actors follow headline campaigns. Require MFA, screen for breached passwords, and add anomaly-based login throttling for customer and staff accounts.
- Prepare for downstream fraud. Firms holding the affected data types should alert customers to voice phishing and loan fraud that uses leaked personal and financial details, and should watch for account takeover attempts.
Sources: Hacks widen as 5 more Korea finance firms confirm data breaches - C... | Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Fi... | 금융권 개인정보 유출 확산…'AI 활용 해킹' 가능성에 비상 - BBC News 코리아 | South Korea probes bank breaches amid suspected AI-powered attacks | Hacker used ARTEX AI and Claude agents to target South Korean banks | 16 Financial Firms, Including Crypto Exchange Gopax, Hit by Data Le... | Saemaul Geumgo and OK Savings Bank Breached... Hacking Spreads Acro... | Shinhan, Kookmin, Hana data breaches fuel concerns over AI-powered...