AI Cyberattacks Expose 100,000 Records at 16 South Korea Financial Firms as AI Lowers Bar for Hacking

AI Cyberattacks Overwhelm South Korea's Financial Sector

South Korea is grappling with a sharp escalation in AI cyberattacks that have compromised 16 financial firms and exposed approximately 100,000 records containing sensitive personal information, including resident registration numbers3

3

5

5

. The scale represents more than double the seven firms initially reported, with the tally expected to rise as companies continue investigating their systems for intrusion signs5

5

. Affected institutions span banks like Shinhan, KB Kookmin, BNK Busan, and Hana, alongside savings banks, credit finance companies, electronic payment providers, and cryptocurrency businesses5

5

.

The Financial Services Commission is conducting in-depth investigations to determine whether AI tools powered these hacking incidents and whether a single hacking group orchestrated the campaign3

3

5

5

. Nine South Korean banks and two mega-churches are probing cyberattacks that may have involved AI tools, marking a troubling trend where AI lowers bar for cybercriminals with limited technical expertise1

1

2

2

.

How AI-Driven Cyberattacks Are Changing the Threat Landscape

Cybersecurity specialists confirm that AI is fundamentally transforming cybercrime by automating tasks from vulnerability scanning to crafting phishing campaigns, making attacks faster, cheaper, and harder to detect1

1

2

2

. U.S. cybersecurity company CrowdStrike identified a suspected 26-year-old China-based attacker behind the South Korean bank incidents who likely could not have executed the campaign without AI assistance1

1

4

4

. The individual used a Chinese-developed AI agent and Anthropic's Claude Code to pursue financial gain1

1

2

2

.

Adam Meyers, CrowdStrike's senior vice president of counter adversary operations, noted that while the hacker's capabilities were not terribly sophisticated, they were effective, underscoring how AI democratizes cybercrime1

1

2

2

. Choi Kyoungjin, director of the Center for AI, Data and Policy at Gachon University near Seoul, explained that with general-purpose AI models, even ordinary users with malicious intent can ask systems to identify vulnerabilities, and the AI will perform much of that work autonomously1

1

4

4

.

Japan Faces Unprecedented Surge in Hacking Incidents

South Korea and Japan are both experiencing dramatic increases in cyberattacks. Japan recorded more cybersecurity incidents in the first nine months of the year than in all of last year, with incidents rising to 86 in September—up about 18% from August and 37% from July, according to TrendAI data1

1

4

4

. Japanese companies including Daiwa Securities, SoftBank Corp, and the Lawson convenience store chain have been hit by this surge1

1

2

2

.

Nobuo Miwa, president of Tokyo-based cybersecurity firm S&J Corp, characterized the situation starkly, stating that Japan is essentially being subjected to carpet bombing by AI-powered attacks that never tire1

1

2

2

. The rise suggests attackers have crossed a threshold in effort, motivation, and technical capability, while AI has largely erased language and other barriers that once hindered foreign hackers1

1

4

4

.

Rising DDoS Attacks and Ransomware Threaten Financial Stability

South Korea reported 1,236 cyber incidents in the first half of the year, up 20% from a year earlier1

1

4

4

. While server hacking cases declined, reports of DDoS attacks and ransomware surged 56.7% and 76.8% respectively, according to government data1

1

2

2

. Although data breaches have not yet resulted in material financial losses, Karen Wu, senior analyst at Fitch, warned that risks could escalate if stolen data is weaponized in phishing campaigns or text-message smishing campaigns1

1

4

4

. Wu expects the incidents to result in regulatory penalties, customer compensation costs, and sector-wide increases in cybersecurity spending1

1

2

2

.

Security Inspections Reveal Widespread Deficiencies

Security inspections of 555 financial firms revealed deficiencies at 130 companies, representing 23.4% of those reviewed5

5

. Common problems included missing security updates, inadequate oversight of unsupported systems, lack of 24-hour security monitoring, and gaps in authentication and authorization for external systems5

5

. These deficiencies were particularly widespread among electronic financial services providers and online investment-linked finance companies5

5

. FSC Secretary General Shin Jin-chang expressed deep concern that financial firms continue failing to meet basic security requirements despite repeated warnings following earlier incidents, including the massive 2025 Lotte Card data breach5

5

.

Tech Giants Sound Alarm on AI-Assisted Attacks

Warnings about AI's expanding role in cybercrime are increasingly coming from the technology's own developers. Alphabet's Google and Anthropic have both cautioned that AI-assisted attacks are becoming more common globally1

1

4

4

. John Hultquist, chief analyst at Google's Threat Intelligence Group, stated last month that we can now assume all threat actors are using AI in some capacity and their operations have benefited1

1

2

2

. Meyers emphasized that the genie is out of the bottle, underscoring the need for stronger security controls and more rigorous testing as AI evolves1

1

4

4

.

Regulatory Response and Future Outlook

Regulators in both countries have launched responses to the crisis. South Korea's Financial Services Commission has directed financial industry associations, regulators, and affected executives to complete a 12-point cybersecurity self-assessment1

1

4

4

. The FSC plans to conduct security inspections at financial firms and prepare measures for early detection of hacking threats and coordinated response3

3

. Broader reforms are under consideration, including measures to hold CEOs and boards more accountable5

5

.

In Japan, digital transformation minister Toshiharu Furukawa convened a meeting of ministries and agencies following the recent attacks, with the National Cybersecurity Office planning to issue warnings to businesses1

1

2

2

. Miwa expects elevated levels of cyberattacks to persist, noting that attackers have experienced a breakthrough rendering many old assumptions obsolete, and that defenses need their own breakthrough to counter this evolving threat1

1

4

4

.