AI in action · Regulation
Korea's AI Hacking Probe: 16 Firms Hit, 130 Fail Checks
South Korea's regulators say 16 financial firms were breached in a hacking wave that may have used AI, and 130 of 555 firms reported security gaps. Large firms will now face vulnerability checks twice a year.
The breaches at South Korean lenders that began after September 30 have turned into a sector-wide review of financial cybersecurity. At a second emergency meeting on October 14, the Financial Services Commission and the Financial Supervisory Service said incidents had been confirmed at 16 financial companies, up from 11 known earlier, spanning banks, savings banks, mutual finance, capital firms, online lending platforms and a crypto exchange operator, Streami, which runs Gopax. About 100,000 records were leaked, including names, phone numbers, resident registration numbers and email addresses. No account or card numbers that could be used for direct fraudulent payments have been found, SBS and The Asia Business Daily reported.
The AI link is a suspicion, not a finding. At the first emergency meeting on October 4, FSC chairman Lee Eok-won said: "While it is difficult to say definitively, the possibility of hacking attacks using AI cannot be ruled out," according to The Financial News, which also noted that the weaknesses exploited were conventional ones. CrowdStrike reported on October 7 that at least some of the bank intrusions were run by an attacker driving an open-source penetration tool through a commercial AI coding agent. Either way, the regulators' response treats speed and scale, the things AI adds to an attack, as the problem to plan for.
The self-inspection results explain the urgency. Of 555 financial companies that completed a 12-item checklist by October 8, 130 reported deficiencies, mostly in one or two areas: missing security patches, systems whose manufacturer support had ended, no real-time monitoring and poor control of internet-facing systems. Electronic finance and online investment-linked lending firms had relatively more gaps. Each firm has filed a remediation plan.
The measures go beyond patching. Vulnerability assessments, now required once a year, will rise to at least twice a year, starting with large firms that have many customers and external access points. Firms must catalogue every connection to outside networks with defined authentication and access rights, and new guidance will spell out security reporting lines and responsibilities for the chief executive, the chief information security officer and the chief information officer. Secretary General Shin Jinchang spoke of "ensuring accountability among CEOs and boards of directors." Smaller firms will get help, including a Financial Security Institute review of an AI-based joint security monitoring system, and moneylenders and insurance agencies outside the electronic-finance law will receive guidance on AI threats.
For customers, the earlier instructions still apply: breached firms must notify those affected and compensate confirmed harm, and watch for voice phishing and smishing using the stolen details, a common next use of a leaked phone number and ID. For other regulators, Korea is now a test case of what happens when an AI-assisted intrusion hits many small firms at once: the weakest systems in the sector, not the biggest banks, set its level of exposure.
Sources: SBS News — Financial sector hacking victims total 16 companies, about 100,000 cases of personal information leaked (Oct 14, 2026); The Asia Business Daily — About 100,000 records exposed in financial firm breaches; FSC to inspect security systems across the sector (Oct 14, 2026); The Financial News — "Cannot rule out AI use": financial authorities adopt highest-level emergency response posture against cyberattacks (Oct 4, 2026); Infosecurity Magazine — Chinese Hacker Deployed AI in Campaign Against South Korean Banks (Oct 2026)