Skip to content

Back to the catalog

AI cyberattacks in South Korea affect around 40,000 savings bank customers
en.cryptonomist.charticle

AI cyberattacks in South Korea affect around 40,000 savings bank customers

CrowdStrike's October 7 investigation into breaches at seven South Korean financial firms (Shinhan Bank, KB Kookmin, Hana Bank, BNK Busan, Yegaram Savings Bank, Welcome Savings Bank, Hyundai Capital) recovered Claude Code session logs, memory files and configurations alongside ARTEX, an open-source Chinese-origin pentesting tool, plus Chinese-language prompts left on publicly exposed server directories. Detection times ranged from 15 hours at Shinhan to 68 hours at KB Kookmin, exposure ranged from dozens of records to roughly 40,000 Yegaram customers, and South Korean regulators responded by canceling planned network-separation exemptions and ordering security inspections at about 500 companies.

TL;DR CrowdStrike found Claude Code and the Chinese ARTEX pentest tool used in AI-assisted breaches of seven South Korean banks, exposing data on up to 40,000 customers.
Open original ↗
Document

What it is

CrowdStrike's October 7 investigation (researcher Ashley Campion) into AI-assisted breaches at seven South Korean financial firms. Beyond what the catalog summary covers, the page adds per-institution exposure figures, the attribution confidence level, and the attack surface the operators targeted.

How it works

Hackers focused on weaker external-facing services rather than banks' own internal systems — the entry point was third-party/external infrastructure, not core banking systems. CrowdStrike's attribution — Chinese-speaking, financially motivated operator — is rated only moderate confidence, resting solely on the Chinese-built ARTEX tooling and recovered Chinese-language prompts, not on linkage to any named adversary group.

Preconditions / Affected

Per-institution breakdown beyond the aggregate figures already known:

  • Shinhan Bank: 25,727 records (detected in 15 hours)
  • KB Kookmin: 119 records (detected in 68 hours)
  • Hana Bank: 89 records (detected in ~42 hours)
  • BNK Busan: 11 outsourced developers' information
  • Welcome Savings Bank: 2,200 corporate records
  • Hyundai Capital: 146 loan agents
  • Yegaram Savings Bank: ~40,000 customers

No demonstrated financial contagion or direct theft of bank funds has resulted from any of these breaches.

What to do

The page states no technical remediation steps or detection queries — regulatory response only: South Korea canceled planned network-separation exemptions and ordered inspections at ~500 companies. Regulators are now prioritizing tighter security controls, closer scrutiny of third-party/vendor services (consistent with the external-service attack vector), and faster breach-containment response.

Caveats

  • Attribution to a Chinese-speaking, financially motivated actor is explicitly moderate confidence, not established fact.
  • Cited external context (not specific to this incident): IMF's June report found AI-enabled adversary activity up 89% between 2024-2025 with average breakout time down to 29 minutes; PwC survey found only 22% of security/finance leaders would permit AI to operate fully autonomously in defense.
  • The "no financial contagion" finding is as of the article's publication — OECD and BIS are flagged as warning of longer-term contagion channels (shared cloud/AI providers, deposit withdrawals, tighter lending) that haven't yet materialized here.

Organisations named here

  • Ashley Campion
  • Financial Services Commission
  • KB Kookmin
  • Lee Eog-weon

Technologies named here

  • Claude Code
  • Shinhan Bank
  • ARTEX
  • KB Kookmin Bank
  • Hana Bank
  • BNK Busan
  • Yegaram Savings Bank
  • Welcome Savings Bank
  • Hyundai Capital
  • CrowdStrike

Techniques named here

  • AI-assisted vulnerability discovery and exploitation
  • Targeting weaker external/third-party services

Threat actors named here

  • Unnamed Chinese-speaking, financially motivated operator

Related in Threat Intel