AI-Assisted Bank Hacks Expose a Blind Spot in South Korea’s Cyber Defenses

AI-assisted hackers are exposing a dangerous gap in South Korea’s financial sector defenses. Banks walled off their core systems, yet attackers still stole their customers’ most sensitive data. As South Korea begins modernizing its cybersecurity regulations, Washington has an opportunity to help a key ally strengthen its defenses. On October 7, CrowdStrike reported that a hacker had targeted South Korean financial firms from late September through early October 2026. The attacker accessed a loan inquiry service platform for brokers and an employee mobile-work support system. Breaches at seven or more institutions, including Shinhan Bank, KB Kookmin Bank, and Hana Bank, reportedly exposed the personal data of at least 68,000 people. CrowdStrike assessed, with moderate confidence, that the hacker was a financially motivated Chinese-speaking actor. The hacker used ARTEX, an open-source agentic penetration testing tool developed in China and powered mainly by DeepSeek. The hacker also asked Anthropic’s Claude where to sell stolen Korean data. On October 9, South Korean security firm Logpresso later linked the Telegram account from the Claude sessions to GodNet/VITAS, a Chinese distributed-denial-of-service (DDoS) group available for hire, but cautioned against attributing the intrusions to one individual. Logpresso noted that the person associated with the disclosed phone number denied involvement and alleged identity misuse. South Korean President Lee Jae Myung warned, “It’s now become possible to use AI to hack with ease even without specialized skills.” Network Separation Alone Cannot Protect South Korea’s Financial Sector Since 2014, South Korean regulators have required financial institutions to physically separate internal business networks from the internet. Hackers bypassed that barrier by exploiting internet-facing services used by employees and loan agents. Banks maintained that their core networks were never compromised, yet customers still lost names, resident registration numbers, and loan records. Regulators cited weak authentication and excessive data retention. At three major banks, the intrusions went undetected for between15 and 67 hours. Network separation also limited the banks’ access to cloud-based AI cybersecurity tools. In May 2026, South Korea’s Financial Services Commission began easing the restriction, initially allowing 49 qualifying institutions to apply for temporary exemptions. In September, the commission expanded eligibility to 75 institutions. But regulatory reform alone will not address the authentication, data protection, and monitoring failures exposed by these breaches. Washington and Seoul Should Strengthen Financial Cyber Defenses Together The United States and South Korea should work together to address vulnerabilities in the financial sector, particularly as Seoul modernizes its cybersecurity regulations. The evidence of this campaign came from U.S. companies, with CrowdStrike exposing the hacker’s infrastructure, and the hacker using Anthropic’s Claude to search for buyers. Seoul’s easing of network separation now opens Korean banks to cloud-based defenses that the segmentation regulation had kept U.S. providers from offering. The State and Treasury Departments should revive the U.S.-ROK Cyber Policy Consultations to launch a financial sector track with South Korea’s Ministry of Foreign Affairs and Financial Services Commission. That track should connect Korean banks with U.S. cybersecurity firms and AI developers, to share indicators of malicious AI use and conduct joint exercises to test defenses against AI-assisted intrusions. Washington should also engage AI developers to identify and share indicators of malicious AI use, including abuse patterns that could inform threat detection without exposing sensitive user information. However, effective information sharing requires legal certainty for participating companies. Congress should therefore enact a long-term reauthorization of the Cybersecurity Information Sharing Act of 2015, currently extended only through December 11, 2026. Its protections for voluntary cyber threat information sharing allow U.S. firms to share threat indicators without legal risk or unnecessary disclosure of sensitive information. If allied institutions are to benefit, that pipeline must stay open. Jiwon Ma is a senior policy analyst at the Center on Cyber and Technology Innovation (CCTI) at the Foundation for Defense of Democracies (FDD), where Zoe Rice is an intern. For more analysis from the authors and CCTI, please subscribe HERE. Follow FDD on X @FDD and @FDD_CCTI. Follow Jiwon on X @jiwonma_92. FDD is a Washington, DC-based, nonpartisan research institute focusing on national security and foreign policy.