Hackers breach South Korean banks with Chinese AI tool Artex, expose 68,000 people

Hackers used a Chinese artificial-intelligence agent to attack South Korea's biggest banks and steal the personal information of 68,000 people, officials said.

South Korea's National Police Agency opened a probe on October 6, 2026, after officials said the intrusions, first identified around September 30, 2026, hit at least seven financial institutions.

What happened

Investigators in Seoul said the attacks, initially detected last week, hit at least seven South Korean financial firms and showed traces of a cybersecurity tool called Artex AI that was developed in China.

The incidents first came to light on September 30, making them the first known example of AI agents hacking the financial sector.

The impacted financial companies include Hana Bank, KB Kookmin Bank and Shinhan Bank, with Shinhan reportedly saying personal data belonging to roughly 25,000 customers was exposed.

Financial authorities said they had so far found 33 IP addresses used in the hacks, according to local news reports.

Impact

Officials said hackers stole the personal information of 68,000 people in the breaches, marking one of the first such AI-powered intrusions into the global financial system.

The breached data included details about individual customers' borrowing history, incomes, phone numbers and names, the Korea Herald reported.

The IP addresses used in the attacks have been linked to at least 12 countries, including Japan, the United States, Thailand, Vietnam and Hong Kong, the Financial Supervisory Service reportedly said.

Response

South Korea's National Police Agency said its cyber terror unit opened a probe into the breach.

President Lee Jae Myung said signs had emerged suggesting AI agents were deployed in at least some of the attacks.

Lee pledged to devote significant staff and money to swiftly and clearly ensure the hacks do as little damage as possible.

The National Office of Investigation said it had created a team of 28 investigators to work the case, according to local news reports.

Lessons for security leaders

The episode shows that agentic AI tools can lower the skill threshold for intrusions into well-defended sectors like banking, so financial-sector security teams should assume adversaries can now automate reconnaissance and exploitation at scale rather than relying on manual tradecraft. Multiple institutions were hit in a short window, which argues for sector-wide information sharing on indicators such as the IP addresses authorities have circulated, rather than each bank investigating in isolation. Because the compromised data reportedly included income and loan details tied to internal sales-support systems, leaders should review which internal tools hold sensitive customer financial data and whether those systems have the same monitoring and segmentation as customer-facing banking platforms. Finally, the swift formation of dedicated investigative teams and cross-border IP tracing suggests organizations should have incident-response plans that assume an AI-enabled attacker and international infrastructure from the outset.