AI hackers hit Korea's biggest banks, and regulators fear it is only the beginning

Within a few days in early October, three of South Korea's biggest banks admitted that hackers had reached customer data. Shinhan Bank went first, saying an outside party had accessed its services and taken information on about 25,000 customers. KB Kookmin and Hana Bank followed. Experts quoted by Yonhap said AI agents were probably used to find the weakness at Shinhan, as reported by The Star.

That possibility has alarmed regulators far more than the number of records involved. If attackers can use AI tools to scan bank systems for weak points faster than defenders can patch them, every financial institution becomes a target. Korea's Financial Services Commission responded with an emergency meeting and an industrywide security review, and its chairman said the possibility of AI powered attacks cannot be ruled out.

What happened at each bank

Shinhan's breach was the largest. The bank said the intrusion came through a mobile inquiry service used by loan agents to check application progress, and that the attacker got past identity checks on it. The exposed data included names, phone numbers, annual income and loan limits, along with 66 resident registration numbers and 97 identifiers used for online identity verification.

KB Kookmin reported a much smaller incident affecting 119 customers. According to Korea JoongAng Daily, an AI agent is believed to have compromised an employee mobile work support system, exposing names, phone numbers, addresses and encrypted resident numbers, but not financial transaction data. Some secondary reports gave far larger numbers for KB, which conflict with the bank's own count.

Hana Bank said 89 customers were affected through its sales support system, with data including resident registration numbers, names and addresses. It said its internet and mobile banking systems were not involved, as noted by the Korea Herald.

Why AI changes the threat

The suspected use of AI is what makes these incidents different. Traditional attacks require skilled hackers to probe systems manually, which takes time. AI agents can automate much of that work, scanning for misconfigured services, weak authentication and forgotten interfaces at a speed and scale no human team can match.

Notably, the weak points in all three cases were not the main banking apps but secondary systems: a loan agent portal, an employee support tool and a sales system. These are exactly the kinds of peripheral services that receive less security attention, and they are where automated scanning is most likely to find gaps.

The front door of a bank is usually well guarded; AI makes it cheap to try every side window at once.

Attribution remains uncertain. No specific AI tool has been confirmed, and the expert view that AI agents were involved has not been verified by investigators. But regulators are acting as if the threat is real, which is the prudent assumption.

The regulator's response

The Financial Services Commission held an emergency meeting and ordered a security review across the industry, while the Financial Supervisory Service began emergency on site inspections. FSC Chairman Lee Eog-weon said the possibility of AI powered attacks cannot be ruled out.

The review quickly turned up problems. A 12 point cybersecurity checklist covering 555 financial companies, completed by 8 October, found that 130 firms had security deficiencies requiring correction. Reports also said breaches at 16 financial firms, including two crypto operators, exposed about 100,000 customer records in total.

Those numbers suggest the problem is systemic rather than isolated. If nearly a quarter of financial firms reviewed had gaps, the three bank breaches may be the visible part of a much wider exposure.

What it means for customers

For affected customers, the immediate risk is not direct theft from accounts. Reports indicate there is no confirmed evidence that payment credentials or data enabling unauthorised transactions were stolen. The bigger danger is phishing. Criminals who know a customer's name, phone number, income and loan limit can craft very convincing scam calls and messages.

Customers should take practical precautions:

• Treat unexpected calls or messages about loans or accounts with suspicion, even if the caller knows personal details.
• Never share passwords, one time codes or verification numbers by phone or message.
• Check account activity regularly and report anything unusual immediately.
• Use the bank's official app or website to verify any request, rather than links in messages.

We have covered how AI is reshaping financial crime, including the arms race against AI powered fraud. The Korean breaches show that the same tools can be turned against banks' own systems.

Lessons for Southeast Asian banks

Southeast Asia's banks should treat Korea as an early warning. The region has rapidly digitised banking, with super apps, digital banks and e-wallets connecting millions of customers through complex networks of partners, agents and APIs. Each of those connections is a potential entry point, especially peripheral systems built for agents and staff.

Regulators across the region have already tightened cyber rules, from Singapore's technology risk guidelines to the Philippine central bank's guidance on AI driven threats. Korea's experience suggests the next step is systematic testing of secondary systems, not just core banking platforms, and faster detection. Reports said Shinhan took many hours to detect the intrusion, a delay that automated attacks can exploit.

The deeper lesson is that defence must become as automated as attack. Banks that rely on periodic manual reviews will struggle against adversaries that probe continuously, which is why investment in AI based monitoring and rapid patching is becoming a regulatory expectation rather than an option.

Security in the age of AI

Korea's bank breaches were modest in size, but they may mark a turning point. For the first time, a major banking system has faced a cluster of attacks where AI tools are seriously suspected, and the regulator's review exposed widespread weaknesses.

The response will shape how banks everywhere think about security. Protecting customer data now means guarding every service, however minor, and assuming that attackers have tireless automated help. The banks that adapt fastest will protect both their customers and their reputations.

Korea's cluster of bank breaches is a warning that the age of AI assisted hacking has reached the financial system. The data stolen was limited, but the method and the weaknesses exposed across 130 firms point to a much larger challenge. Banks in Korea, Southeast Asia and beyond now face attackers that never tire, and the only credible answer is defence that is just as fast, just as thorough and just as automated.