South Korean Government Confirms AI Use in Bank Hack and Orders Full Investigation

Government Announcement and Overview of the Hack

At the cabinet meeting on 6 October 2026, President Lee Jae‑myung addressed the recent series of bank hacking incidents, stating that investigators have captured indications that an artificial‑intelligence (AI) model was used in at least some of the attacks. The president noted that customer personal data had been exposed in several cases and directed a rapid, full‑scale investigation aimed at limiting further harm. The announcement followed the Financial Services Commission’s (FSC) detection of the breach on 2 October and the chairman’s directive on 4 October for all relevant agencies and financial institutions to adopt the highest level of alert. Police have already begun inquiries focused on the major commercial banks that reported suspicious activity, namely Shinhan Bank, KB Kookmin Bank, Hana Bank and Woori Bank. Cyber‑security experts point to the simultaneous appearance of abnormal login attempts and automated scripts as evidence that AI‑driven automation tools may have been employed. Attackers accessed a large number of accounts within a short window, attempting fund transfers and, in some reports, achieving unauthorized withdrawals. This pattern differs from traditional hacking techniques, suggesting that AI could have analyzed massive data streams in real time and selected optimal attack paths.

Evidence of AI Use in the Attack

The police cyber‑unit together with the Financial Security Institute have identified 28 distinct IP addresses that are believed to have been used in the intrusion, and they have traced the geographic origin of those addresses to Southeast Asia and Eastern Europe. Several of the IPs showed links to servers operated by cloud‑service providers. Investigators are examining the possibility that an AI model automatically scanned for vulnerabilities and generated custom‑written attack code tailored to the targeted banking systems. To date, no public disclosure has confirmed which specific AI tool was employed, nor whether the perpetrators modified an open‑source model or built a proprietary one. Authorities are conducting parallel log‑analysis and behavior‑based detection to determine the extent of AI involvement.

Responses from Relevant Agencies and International Context

Following the FSC’s awareness of the hack on 2 October, it immediately requested the Financial Supervisory Service and the Financial Security Institute to assess the situation. On 4 October the FSC chairman instructed all related agencies and major financial firms to establish the highest level of vigilance and to put in place a coordinated response framework. Banks have been ordered to re‑examine their internal security systems and to monitor suspicious transactions in real time. The National Police Agency has formed a dedicated task force to trace the attack pathways and identify the perpetrators; so far, no direct connection to an overseas hacker organization has been detected. The Financial Supervisory Service is notifying affected customers promptly and recommending that they change passwords and other authentication credentials. The list of banks currently under investigation includes: - Shinhan Bank - KB Kookmin Bank - Hana Bank - Woori Bank

The Korean government’s heightened alert is also informed by recent overseas incidents. Australia and Canada have each reported attempts to infiltrate financial systems using AI agents, prompting those nations to tighten security policies. Australia has deployed a real‑time analytics platform designed to block AI‑generated phishing emails and automated scripts, while Canada has introduced a legal and technical framework aimed at preventing the misuse of AI models. These international developments provide valuable reference points for South Korea as it builds pre‑emptive defenses and response mechanisms against AI‑enabled cyber‑attacks.

Limitations, Damage Mitigation and Future Measures

At this stage, authorities find it difficult to quantify precisely how much the AI component contributed to the overall attack. They have not yet secured concrete details about the type of AI tool, the data on which it was trained, or whether the attackers developed the model themselves or leveraged an external one. The full scope of the breach and the exact monetary losses remain unclear, complicating efforts to estimate total damage. Experts caution that while AI‑based attacks can operate faster and achieve higher success rates than conventional hacks, the current evidence is insufficient to conclude that AI was responsible for every step of the operation. President Lee has ordered a comprehensive investigation and called for legislative and regulatory reforms to address AI‑facilitated hacking. Financial regulators plan to introduce AI‑driven detection technologies to identify threats in real time, and banks have been urged to strengthen customer authentication procedures and adopt AI‑based security solutions. Affected customers will receive swift compensation and will be offered privacy‑protection education. The government also announced that it will continuously monitor cases of AI misuse and will work with international partners to share information and develop joint response strategies.