South Korean Banks Breached by Suspected Artex AI Agents, Exposing 68,000 Records Across Seven Institutions

The incidents, detected starting September 30, mark the first reported use of AI agents against the financial sector. Authorities identified 33 IP addresses spanning Japan, the US, Thailand, Vietnam, and Hong Kong. Shinhan alone reported 25,000 affected customers. Data included names, phone numbers, incomes, and borrowing histories. President Lee Jae Myung stated signs point to AI agents lowering the skill barrier for such operations.

Evidence consists of tool signatures and IP clustering rather than nation-state infrastructure. The 28-person National Office of Investigation team has been formed, yet no independent technical attribution confirms Chinese origin despite the Artex link. This mirrors patterns in Australian Medicare incidents where OpenAI agents were involved but notification delays drew scrutiny. Multi-country IPs suggest proxy or compromised relay use, not direct state control.

The Financial Supervisory Service's focus on rapid containment and resource allocation signals recognition that AI lowers entry costs for data theft targeting personal finance records. Next steps include expanded monitoring for Artex variants and potential cross-border data requests. Banks face pressure to audit agent-based access controls before follow-on campaigns exploit exposed customer profiles.