South Korean Bank Breaches Hit 25,000: Credential Stuffing and AI Tool Claims Examined

What happened​

Shinhan Bank disclosed a breach affecting about 25,000 customers. The next day, other banks reported their own incidents.

The Financial Services Commission (FSC) held an emergency meeting on Friday, October 2, chaired by Secretary General Shin Jin-chang. Its own notice lists attendees from the Financial Supervisory Service, the Korea Financial Security Institute, six banks, three card companies, and the banking and credit-finance associations. The FSC tied the meeting to the September 30 Shinhan leak and to follow-on attacks that caused additional harm at major financial firms, including KB Kookmin.

Regulators said they began on-site investigations as soon as the reports came in. They also shared threat information, including attacker IP addresses and attack methods, with agencies such as KISA.

The incidents, bank by bank​

The details differ by institution, so it's worth keeping them separate.

• Shinhan Bank: An unauthorized party bypassed authentication on a service used by loan agents to check application status. The exposed data included names, phone numbers, annual income and borrowing limits, plus other personal and credit information from loan applications. The Herald Business put the figure at 25,729 people. The bank said its core deposit and transfer systems were not affected.
• KB Kookmin Bank: Personal information on 119 customers leaked from a mobile work-support system used by employees. Seoul Economic Daily reported that the exposed items included names, phone numbers, addresses and encrypted resident registration numbers. The bank said the breach was unrelated to internet and mobile banking, and it pledged full compensation.
• Hana Bank: Hana said 89 customers' data was exposed. The Korea Times reported the access was to a sales-support system. Hana described it as an operations support system (ODS), and the data included resident registration numbers, names, addresses, contact details and employer information.
• BNK Busan Bank: The Korea Times reported that personal information on 11 outsourced workers leaked.
• Woori Bank and NH NongHyup Bank: Both reported attacks, but said no information was exposed. Seoul Economic Daily said Woori saw attempts from September 29 through October 1.

One correction matters here. Some syndicated coverage says Kookmin leaked credit-card data on 119,000 clients. Korean reporting consistently says 119 customers and describes personal information, not a mass credit-card leak. This article uses the 119 figure.

Yonhap reported that police have opened a preliminary inquiry. The Korea Times says it covers Shinhan, KB Kookmin, Hana and BNK Busan.

Why the target list matters​

The Herald Business reported that every attack hit internal employee or partner-facing systems. None hit customer-facing internet or mobile banking. The Korea Times makes the same point: these were not assaults on the banks' core IT networks.

That is the lesson for IT admins. Shinhan had reportedly scored a perfect 100 on the FSC's personal credit information protection inspection five years running. It also holds ISMS, ISMS-P and ISO 27001 certifications, according to Seoul Economic Daily. Even so, a simplified inquiry service for loan brokers exposed tens of thousands of records. Certifications and audit scores don't guarantee that the forgotten side door is locked.

The AI question: what is known and what isn't​

The AI angle rests on a thin but interesting piece of evidence. Genians Security Center head Moon Jong-hyun said on LinkedIn that a string containing "ARTEX" and a Chinese phrase for an autonomous penetration-testing console appeared in some HTML titles of a web server presumed to be involved. He added that many threat analysts reasonably suspect an AI-based attack automation tool.

ARTEX AI is an open-source, LLM-based autonomous penetration-testing framework. Its public GitHub page shows about 1.6k stars and 332 forks. Reporting describes it as automating reconnaissance, vulnerability discovery, attack-path planning, tool execution and validation.

Here is what the evidence does not show:

• Neither the banks nor the authorities have confirmed that ARTEX was used.
• The string does not tie the attacks to any particular threat actor. Professor Lee Sang-geun of Korea University said it is difficult to conclude this was the work of a particular country.
• One analysis noted that no published logs, command history, model records or official forensic findings show ARTEX executing any part of the intrusion.
• The FSC chairman did not rule out AI use in the attacks, per Yonhap. That is not the same as confirming it.

A console title on a server shows that someone may have run, or copied, this tool's interface. It does not show what the tool did, or that the same method hit every bank.

Credential stuffing, probably​

The Korea Times says the server is suspected of use in a credential stuffing attack. It describes the technique as using stolen usernames and passwords against other services, often through large-scale automated login attempts. Seoul Economic Daily's opinion section states that investigators determined the intruders got in this way.

But the reporting is not uniform. Yonhap's Shinhan account, as relayed by one analyst site, says the intruder bypassed identity verification and manipulated query inputs. A bypass and credential stuffing are different failures. This difference is unresolved in the public record, and it's why firm root-cause claims should wait for the forensic findings.

If AI is involved, the plausible value is speed and scale, not magic. A Korean professor quoted by Seoul Economic Daily noted that much of the work of preparing and operating attack tools can now be automated, and that internet-facing systems with weak authentication are the exposed ones. Reports also noted that attempts clustered in a narrow window, which has fueled speculation about a common actor. That remains speculation.

What the regulator told banks to do​

The FSC's directions are a decent template for any enterprise.

• Inspect all externally exposed systems and services immediately. This includes systems that aren't customer-facing, and the point is to leave no blind spots.
• Minimize unnecessary information exposure. Check for paths that reach internal data without authentication.
• Audit authentication in data lookups. Make sure verification steps aren't missing or loosely applied wherever personal data is queried.
• Share attacker IPs, methods and attempted-intrusion details quickly across institutions and agencies, since similar attempts may hit others.
• Submit self-inspection results promptly. The FSC said it would supply a vulnerability checklist.

The regulator also said it would oversee consumer protection and compensation, and analyze the causes to develop regulatory improvements. These are Korean regulatory instructions, not requirements for organizations elsewhere.

Practical takeaways for admins​

This section is general industry guidance based on the reported facts, not claims from the sources.

• Inventory what's reachable from the internet, including broker portals, staff mobile tools, contractor web pages and sales-support apps. The incidents involved exactly this class of system.
• Put real authentication in front of anything that returns personal data. Use MFA where feasible, and add rate limiting and bot detection against automated login floods.
• Watch for credential stuffing signatures: many failed logins across many accounts from few IPs, or valid-looking logins from unusual sources.
• Check partner and outsourced-worker exposure. Busan Bank's leak involved outsourced developers, and the Korea Times noted customer data is increasingly handled by loan brokers and outsourced providers.
• Plan for fast IP blocking and threat-intel sharing. Both Hana and Shinhan blocked attacker addresses, and the FSC made rapid sharing a headline instruction.
• Prepare customer messaging about phishing. The FSC chairman warned that leaked data could still fuel voice phishing, even though no data usable for unauthorized payments appeared to be exposed.

Bottom line​

The established facts are that several Korean banks lost customer data through peripheral, internet-accessible work systems, and that regulators, police and the president are all involved. The AI link is an investigative lead, not a finding. Even so, it is a useful reminder: automation lowers the cost of probing every forgotten login page you own. If your authentication only ever had to survive human patience, it's time to find out whether it survives a bot's.

Update: CrowdStrike links ARTEX AI and Claude agents to the bank attacks (October 10, 2026)​

CrowdStrike has now reportedly confirmed that the South Korean bank intrusions involved ARTEX AI, moving the tool’s role beyond the earlier server-title clue. As reported by BleepingComputer, researchers found infrastructure tied to the attacker containing ARTEX configuration files, Claude Code session histories and persistent Claude memory files, with target records overlapping the banks named in prior reports.

The records indicate that the ARTEX deployment used DeepSeek v4.1-flash as its primary model backend, while separate Claude Code sessions also used GLM-5.3 and Grok 4.6. CrowdStrike said the attacker likely accessed DeepSeek through an API proxy or reseller. This is forensic evidence of AI-assisted tooling in the campaign, not merely evidence that an ARTEX interface appeared on a server.

CrowdStrike also cautioned against treating exposed résumé and contact material as a confirmed attribution. The data may point to a Chinese-speaking operator, but inconsistent biographical details mean the individual’s identity remains unverified. For defenders, the practical change is clear: automated reconnaissance and attack workflows should now be considered part of the confirmed threat model for exposed partner, employee and support systems.