Security · October 13, 2026
Financial Security Institute Warned Banks of AI Hacking Before Data Leaks
The Financial Security Institute shared actual cases of artificial intelligence hacking and urged countermeasures for financial companies approximately two weeks before a series of personal information leaks occurred in the domestic financial sector.
During a seminar on September 17 attended by about 160 security officers, the institute introduced response plans and cases of AI agent attacks targeting domestic financial firms. Representatives from five of the seven financial companies that later suffered breaches attended the event, including KB Kookmin Bank, Hana Bank, Hyundai Capital, Welcome Savings Bank, and Shinhan Bank, the latter of which attended at the financial group level. BNK Busan Bank and Yegaram Savings Bank were the two affected firms that did not attend.
The institute highlighted a September case involving a domestic financial company where an attacker used an AI agent based on the Chinese AI model DeepSeek. The attacker instructed the agent to locate Oracle WebLogic servers and exploited remote command execution vulnerabilities to install a web shell, which is a malicious program allowing remote commands. This allowed the attacker to explore other internal servers, though the victim company blocked the attack before additional malware could be downloaded.
Recent leaks at major firms like Shinhan Bank, KB Kookmin Bank, and Hana Bank involved different methods. Attackers reportedly automated attacks by combining AI models such as DeepSeek with an AI based penetration testing tool called ARTEX. These attacks targeted external business systems, including employee mobile applications and loan solicitor inquiry pages. While the previous case exploited vulnerabilities in external solutions lacking security patches, the recent attacks targeted vulnerabilities in web services operated directly by the financial companies.
The Financial Security Institute stated that AI allows attackers to repeat sophisticated attacks across multiple institutions. It noted that attacks exploiting web application vulnerabilities are difficult to detect with existing firewalls or security monitoring systems because they resemble normal service requests. The institute emphasized that annual vulnerability diagnoses are insufficient and that constant inspection of business systems and servers exposed to the internet is necessary.
Five major commercial bank presidents are scheduled to appear as witnesses at the Financial Supervisory Service national audit on October 19 to be questioned about the details and responses to these hacking incidents.