South Korea Investigates Attacks on 3 Banks: More Than 25,000 Victims, Signs of AI Involvement

    South Korean authorities are investigating cyberattacks on 3 of the country’s largest banks: Hana Bank, KB Kookmin Bank and Shinhan Bank. There are signs that artificial intelligence agents were used in the attacks. An AI agent is software that can carry out an assigned task on its own to some extent. The incidents have heightened concerns about the criminal use of artificial intelligence against banks.    A data breach at Shinhan Bank last week exposed the personal credit information of at least 25,000 customers. In another incident, 99 KB Kookmin Bank customers, as well as 20 current and former employees, were affected. Data belonging to 89 Hana Bank customers was also stolen. The attacks therefore affected both customers and bank employees.    South Korea’s National Office of Investigation has launched an investigation into all 3 incidents. President Lee Jae Myung instructed the government to clarify the situation and minimize the damage. According to him, even people without specialized skills can launch attacks more easily with AI. It is not yet known who was behind the attacks. Finding those who conceal their digital tracks may also prove difficult.    AI-driven attacks have been recorded before. In November 2025, Anthropic disclosed an AI-related cyberattack by a group believed to be backed by the Chinese state. A few months later, Taiwan was targeted by fully autonomous attacks carried out by China-linked hackers. Security researchers also used the Claude model to gain access to OpenAI’s internal source code.    AI labs add safeguards to prevent the illegal use of their models. Nevertheless, hackers can trick these systems into running malware. Protections are sometimes weaker in models whose internal parameters are publicly available. The Australian government also disclosed that OpenAI reported an incident involving the national health portal 84 days late. Although AI does not replace professional hackers, it accelerates attack planning, the collection of information about targets and the execution of attacks.