Shinhan, KB Kookmin data breaches raise concerns over AI-powered cyberattacks

A series of data breaches at Shinhan Bank and KB Kookmin Bank, two of Korea’s largest commercial banks, has heightened concerns in the financial sector over increasingly sophisticated cyberattacks using artificial intelligence (AI).

On Friday, KB Kookmin Bank said that personal information belonging to 119 customers was leaked after abnormal external access to a mobile system used by employees. The leaked information varied by customer and included names, phone numbers, addresses and resident registration numbers in encrypted format.

The bank stressed that the compromised system provides mobile access to work tools for staff and does not handle customer transactions, including online and mobile banking. It also pledged to fully compensate for any losses resulting from the data breach.

"We have activated an emergency response system across the company, including a thorough review of all our processes to prevent further damage and recurrence," a bank official said.

The incident came a day after Shinhan Bank disclosed a data breach affecting about 25,000 customers.

Shinhan said an unauthorized party bypassed authentication to access a service used by loan agents to check the status of applications. The exposed data included customers’ names, phone numbers, annual income and borrowing limits, along with other personal and credit information submitted for loan applications.

According to local media reports, traces of a Chinese-language AI penetration-testing tool were found on a server believed to have been used in the attack, raising concerns that AI could accelerate cyberattacks and broaden their scope. Regulators' investigation remains underway.

The server’s HTML title reportedly contained a Chinese phrase meaning “AI autonomous penetration testing console,” suggesting a possible link to ARTEX AI, an open-source autonomous penetration-testing system built on a large language model. The server is suspected of having been used in a credential stuffing attack against Shinhan Bank.

Credential stuffing involves using stolen usernames and passwords to attempt to access accounts on other services, often through large-scale automated login attempts.

Security experts say advances in AI are lowering the technical barriers to cyberattacks. The technology is moving beyond suggesting attack methods, with AI agents capable of combining disparate information to identify vulnerabilities, launch attacks and refine their tactics based on the results.

The recent breaches at two of the country’s largest commercial banks have heightened concerns about these evolving threats. Financial institutions face particular risks as customer information is increasingly handled by loan brokers, outsourced service providers and digital platforms.

Amid growing concerns, the Financial Services Commission (FSC), the country’s top financial regulator, held an emergency response meeting later in the day. It said it and the Financial Supervisory Service had dispatched investigators to the affected firms as soon as the breaches were reported.

The regulators have also shared details of the attacks, including the IP addresses and intrusion methods used, with relevant agencies to help prevent further damage.

“Preventing data leaks requires financial institutions to maintain a high level of readiness,” FSC Secretary General Shin Jin-chang said. “We will strengthen coordination by monitoring intrusion attempts and rapidly sharing threat intelligence, while examining the causes of the breaches and attack methods to identify and swiftly introduce necessary regulatory improvements.”