South Korea's Lee says AI may have aided bank hacks as police widen probe

South Korean President Lee Jae Myung said artificial intelligence appears to have been used in a wave of cyberattacks on the country's banks, and told officials to put people and money into limiting the damage. Police have opened a full-scale investigation into the intrusions, which have reached Shinhan Bank, KB Kookmin Bank and Hana Bank as well as smaller savings banks and a consumer lender.

"In some hacking incidents, signs have emerged of AI being used, causing considerable public concern and anxiety," Lee said, according to Reuters. "Please establish the circumstances swiftly and clearly, and concentrate personnel and resources on minimising the damage." Authorities have not said which AI tools may have been involved or how far the breaches extend.

Who was hit, and how badly

Figures compiled by Korea JoongAng Daily show the damage spread unevenly across the sector. The largest single breach was at Yegaram Savings Bank, where data on 40,000 customers was exposed. Shinhan Bank lost records on 25,727 customers, while the leaks at KB Kookmin and Hana were far smaller, at 119 and 89 customers. Welcome Savings Bank reported 2,200 corporate customer records leaked, BNK Busan Bank said data on 11 outsourced developers was taken, and Hyundai Capital said 146 of its mortgage loan agents were affected.

The time it took the big banks to notice is one of the more troubling details. Shinhan detected its intrusion after 15 hours and 26 minutes. Hana needed 41 hours and 44 minutes, and KB Kookmin 67 hours and 41 minutes, JoongAng Daily reported. The attackers went after systems facing the internet rather than the core networks that move money, and regulators singled out weak authentication and the habit of keeping more customer data than needed as the main gaps.

Regulators order an emergency sweep

The Financial Services Commission called an emergency meeting with industry leaders on Sunday. "We cannot rule out the possibility that AI was used in the attacks," FSC Chairman Lee Eog-weon said. "The entire financial sector must recognize the gravity of the situation and remain on the highest alert." Roughly 500 financial firms have been warned about malicious IP addresses, and companies must report the results of emergency security checks by Thursday or risk penalties.

The stolen material mostly consists of personal details along with loan and income records, the kind of information that can be used to make voice-phishing calls more convincing. A source at a financial regulator told JoongAng Daily that the immediate risk to accounts is limited. "Passwords and CVC numbers were not directly exposed, so the likelihood of immediate unauthorized transactions is low," the source said. The newspaper reported that a Chinese-language AI hacking tool called Artex AI had reportedly been found in the attacks; authorities have not confirmed its use. No official finding has been released on who was behind the campaign.

What it means

If investigators confirm that AI tools were used in the intrusions, South Korea's banks would offer a rare public case of automated tools turned against a major financial system, and the case will shape how regulators elsewhere in Asia think about the threat. The lesson so far is less about exotic technology than about familiar weaknesses: exposed front-end systems, thin authentication and hoarded data were enough to let intruders in, and detection times measured in days gave them room to work. Lee's intervention raises the political stakes for the FSC and the banks, which now face a Thursday deadline and public pressure to explain the delays. The episode also feeds a wider debate over AI safety, including the plan for a direct Washington-Beijing channel for AI incidents, and it will test whether governments can trace an automated attack back to a specific tool and operator.