South Korea opens a police probe of AI-linked bank intrusions

South Korean police have opened a formal investigation into intrusions at financial firms that officials and banks have tied to AI tools. Yonhap, on 6 October, said the National Office of Investigation formed a 28-member team on suspicion of violations of the information and communications network law. Korea JoongAng Daily the same day said the office booked the case under the Information and Communications Network Act and assigned four teams from its cyberterrorism investigation unit, 28 investigators in all. The Korea Herald reported the same assignment: 28 investigators across four teams.

JoongAng dates the Shinhan attack to 28 September. Yonhap’s 1 October story said Shinhan disclosed that day that information on around 25,000 customers had leaked on Wednesday, and that sources said the attackers, “currently suspected to be based overseas,” used AI tools.

What President Lee said

CNA, carrying Reuters, reported that President Lee Jae Myung said on Tuesday that AI models are believed to have been used in some recent hacking incidents against banks. At a Cabinet meeting, CNA quotes him: “In some hacking incidents, signs have emerged of AI being used, causing considerable public concern and anxiety.” A second sentence in that report: “Please establish the circumstances swiftly and clearly, and concentrate personnel and resources on minimising the damage.”

The Korea Herald, timestamped 6 October, quotes a different line from a Cabinet meeting that day: “Speed is of the essence.” The two outlets are not printing the same sentences.

Police are also asking whether the case must go to the Serious Crimes Investigation Agency. JoongAng says that agency launched on Friday, and that a police official asked the Financial Services Commission whether the affected system counts as electronic financial infrastructure. The Herald quotes a police official still waiting on that interpretation.

Counts, by outlet and date

The Herald Business on 3 October reported Shinhan at 25,729 people, through a loan-agent inquiry service; KB Kookmin at 119 records, from an employee mobile system; Hana at 89 records, from an employee sales system; and BNK Busan at 11 contract workers. It said the attacks it described hit employee or partner systems, not customer internet or mobile banking.

Chosun Biz on 4 October said authorities had confirmed intrusions at seven firms: Shinhan, KB Kookmin, Hana, BNK Busan, Yegaram Savings Bank, Welcome Savings Bank, and Hyundai Capital. Woori is not on that list. Chosun said internet and mobile banking were unaffected and that no monetary damage was confirmed.

The Korea Herald on 6 October said that by Sunday the same seven had reported breaches, and that “Reports put the combined exposure at about 66,000 individuals and 2,200 corporate records,” with Shinhan at 25,729 and Yegaram at about 40,000. That combined line is the Herald’s, attributed to reports.

Woori is where the lists split. CNA, crediting Yonhap, said Hana and Woori had suffered breaches. The Yonhap police story opened here names Hana, KB Kookmin, and Shinhan, and does not name Woori. The Korea Herald says Woori and NH NongHyup “also reportedly faced similar attacks, but no data leaks have been confirmed.”

The tool does not name an attacker

The Herald Business, quoting a Financial Security Institute official, said Shinhan logs pointed to ARTEX AI, which that paper calls Chinese-developed and open-source. The official said AI was used, “but the AI did not act independently without human involvement,” and: “A hacker used the AI as a tool.”

JoongAng calls Artex AI a Chinese-language tool and says traces led some to suggest China was behind the attacks. “But most experts say the tool is open source, so it cannot be used to pin down the attacker.” Chosun says financial authorities found it difficult to name a country or organization, because the tool is public and the addresses span countries, including Korea, the United States, Japan, Hong Kong, Singapore, Vietnam, Thailand, and the United Kingdom.

Tuesday’s address counts also disagree. JoongAng said the Financial Supervisory Service had identified 19 attacker IP addresses in 12 countries. The Korea Herald said the service had identified 28 distinct addresses and asked firms to finish checks by Thursday. The Herald reported the service’s caution that those addresses do not show where attackers are based, because traffic may have been routed through other countries.

The police case, the team of 28, and the President’s Tuesday remarks are in more than one report. Keep each record count with the outlet and the date above. The tool and the foreign addresses, on these accounts, do not identify who broke in.