President Lee Jae-myung recently mentioned that evidence has emerged suggesting artificial intelligence was used in some of the attacks related to the recent hacking incidents at domestic financial institutions, and he called for a transition to a cybersecurity system suited for the AI era. The police have launched a full-scale investigation into the personal information leak at a commercial bank, and financial authorities are also sharing relevant access information and attack indicators with the financial sector.
The most important point here is that we haven't reached the stage where it has been confirmed that "AI hacked the system." According to the Reuters report, it has not yet been disclosed which AI tool was used or the full extent of the attack. Since the president’s statement referred to “circumstances in which AI was used,” the actual course of the attack and who is responsible must be determined through the results of the investigation.
| The president's remarks have caused the issue to extend beyond the scope of a single bank
Although this incident was initially reported as a data breach at a single bank, it escalated into a national cybersecurity issue on October 6 when the President personally mentioned the use of AI during the 43rd Cabinet Meeting. President Lee directed officials to quickly and clearly ascertain the circumstances of the incident and to concentrate the necessary personnel and resources to minimize the damage.
They also emphasized that it is difficult to respond to increasingly sophisticated attacks through post-incident remediation alone, and called for strengthening capabilities for early detection and preemptive blocking. This effectively means that the concern that AI could lower the barrier to entry for automated attacks has been officially incorporated into the government’s response. It is likely that the scope of these efforts will expand in the future to include security system audits not only in the financial sector but also in public institutions.
| Several financial institutions, including Shinhan and KB Kookmin, were subject to the investigation.
Reuters reported that Shinhan Bank and KB Kookmin Bank, among others, had reported cyberattacks, and, citing a Yonhap News report, added that Hana Bank and Woori Bank had also reported security breaches. The police have launched a full-scale investigation into the hacking incidents targeting commercial banks and the resulting leaks of personal information. Authorities are currently assessing whether similar attempts were made across the financial sector as a whole.
You can't assume that the point of entry and the extent of the damage are the same in every case. For example, KB Kookmin Bank revealed that the personal information of 119 customers was leaked from its mobile work support system for employees, and the Shinhan Bank incident involved an even larger-scale data breach. Investigations are needed to determine whether these incidents were caused by the same attacker or the same tool.
| We must distinguish between “circumstances of AI use” and the actual perpetrators of the attacks
Even if evidence confirms that AI was used, that doesn't mean the AI model initiated the attack on its own. The attacker may have used commercial AI tools to help identify vulnerabilities, write code, automate requests, or explore ways to bypass security measures, or an agent-based tool may have automatically executed some of these steps. Based on currently available public information alone, it is not possible to determine the specific method used.
Reuters also noted that the specific type of AI tool used and the full extent of the breach have not been disclosed. Therefore, concluding that “autonomous AI attacked the bank” would be jumping to conclusions. What has been confirmed at this stage is that the authorities and the president have mentioned evidence of AI use in some of the hacking incidents, and that the police and financial authorities are currently investigating these incidents, among other matters.
| Financial authorities shared information on 28 unique IP addresses
Reuters reported that the Financial Supervisory Service and the Korea Financial Security Institute recently shared 28 unique IP addresses linked to recent hacking attempts, along with information on certain countries, with the financial sector. Financial institutions can use this information to check whether their systems have a history of connections from those addresses and assess the potential for further breaches. Rapidly sharing indicators of compromise is a fundamental response strategy for preventing chain reactions of attacks.
However, you shouldn't simply assume that the 28 IP addresses correspond to 28 attackers or 28 attack servers. Attackers can route their attacks through VPNs, proxies, cloud servers, or compromised systems, and a single attacker may use multiple IP addresses. Furthermore, the country associated with an IP address does not necessarily indicate the attacker’s actual nationality. To identify the ultimate attacker, it is necessary to analyze logs, accounts, malware, and infrastructure connections together.
| The problem is that AI can increase the speed and scale of attacks.
Vulnerability scans and brute-force attacks using automation tools were already common. With the addition of AI, attackers can iterate more quickly on tasks such as writing code, manipulating input values, analyzing error messages, and selecting the next stage of an attack. In particular, the effectiveness of attack automation can be significantly greater when there are many points exposed to the internet, such as web-based internal business systems or outdated APIs.
Conversely, financial institutions can also use AI for defense. It is possible to analyze abnormal access patterns in real time, correlate traces of the same attack across multiple system logs, and automatically prioritize vulnerabilities. The president’s emphasis on the widespread adoption of AI-based cybersecurity can be interpreted as a call to prepare for an environment where both attacks and defenses are automated simultaneously.
| Secondary damage can become an even bigger problem in the wake of a data breach
While the leakage of personal information from a bank is a problem in itself, there is also a risk that it could be exploited for phishing, voice phishing, loan fraud, and account hijacking. This is because if an attacker obtains the names, contact information, and some personal details of actual bank customers, they can create more convincing impersonation messages for the victims. Generative AI can also be used to mass-produce these customized scam messages.
Therefore, the financial authorities’ response must not stop at simply blocking the intrusion route. We must clearly inform affected customers exactly what information was compromised and step up monitoring of suspicious transactions and account changes. Since this could lead to further scams disguised as compensation offers or loan consultations, it is crucial to provide guidance to customers and strengthen the detection of suspicious transactions for a certain period following the incident.
| The financial sector needs to reevaluate security, including its internal business systems
The key point to note in this incident is that it is not enough to protect only customer internet banking. Peripheral systems—such as employee support systems, services for loan brokers, and connections to external partners—can also access personal information and internal functions, making them potential attack vectors. As the number of systems that allow external access for the sake of service convenience increases, it becomes necessary to re-evaluate authentication and access control measures.
In particular, if AI-based attack tools can automatically explore numerous paths, a single vulnerability in an outdated system could determine the overall security level. Financial institutions must continuously manage their inventory of internet-exposed assets and simultaneously strengthen multi-factor authentication, the principle of least privilege, anomaly detection, and rapid patching systems.
| Right now, the investigation to determine the method of attack and the extent of the damage is the most important thing.
This incident goes a step further than previous emergency inspections of the financial sector, as the president publicly addressed the use of AI and the police have launched a full-scale investigation. However, the specific types of AI tools involved, the commands issued by the attackers, whether the incidents at various financial institutions are part of the same campaign, and the total extent of personal information breaches have not yet been confirmed.
Therefore, going forward, we need to focus on the forensic findings from law enforcement agencies and financial regulators. If it is confirmed at which stage of an actual attack the AI was used, this could have an impact on the security standards and AI response policies of the domestic financial sector. The crux of this incident lies not in the sensational term “AI hacking,” but in how much the entire financial sector can improve its detection and response speeds as automated attacks become a reality.
Tags
#Financial Sector Hacking #AI Hacking #Cybersecurity #Data Breach #President Lee Jae-myung #Financial Supervisory Service #Financial Security Institute #Shinhan Bank #KB Kookmin Bank #Information Security #AI Security #Financial Security
