iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
South Korean authorities are investigating recent cyberattacks on financial institutions after President Lee Jae Myung said signs of AI use had emerged in some hacking incidents. That is a preliminary indication—not a confirmed finding about how the attacks were carried out. As of Reuters’ October 6, 2026 report, investigators had not identified any AI tools or disclosed the full scale of the breaches.
What South Korean authorities are investigating
Police have launched a full-scale investigation into attacks on commercial banks involving customer personal information. At an October 6 cabinet meeting, President Lee said: “In some hacking incidents, signs have emerged of AI being used, causing considerable public concern and anxiety.” He called for investigators to establish the circumstances and focus resources on minimizing damage. The statement describes signs under investigation; it does not identify a tool, attacker, or confirmed AI-enabled attack chain. Reuters’ October 6 report likewise said authorities had not disclosed which AI tools were involved or the full scale of the breaches.
Which banks have been named?
Reuters reported cyberattacks at Shinhan Bank and KB Kookmin Bank, and relayed Yonhap’s reporting that Hana Bank and Woori Bank also suffered breaches. This is a list of institutions named in reporting, not an official exhaustive account of every affected institution. The Financial Services Commission’s October 2 statement referred more broadly to recent data leaks and attacks at financial companies without supplying a complete bank-by-bank list. Reuters · Financial Services Commission, October 2
What information was exposed—and what remains unknown?
Public reporting describes incidents involving customer personal information, but the sources available by October 6 do not provide a final account of the data categories or the number of affected customers. Authorities had also not published the full incident scope. The reported 28 IP addresses discussed below are indicators shared with financial institutions, not a count of attackers, breaches, or affected customers.
#1 Best Overall
How the government is responding
Financial-sector coordination
On October 2, the Financial Services Commission convened an emergency meeting with the Financial Supervisory Service, Financial Security Institute, major banks, card companies, and industry associations. Participants shared information about recent data leaks and attack methods and discussed security measures for the sector. Financial Services Commission statement
Investigation, customer protection, and security checks
At an October 6 interagency response meeting, Prime Minister Han Duck-soo’s government reviewed information leaks affecting financial and public-sector organizations. It directed the FSC to investigate the scope and causes, oversee customer protection and compensation, and quickly expand security checks across the financial sector. Police were directed to investigate the attackers. The government also said it would share results promptly to reduce anxiety caused by misinformation. Government of South Korea, October 6
Sharing indicators with financial institutions
Reuters reported that the FSS and Financial Security Institute shared information on 28 unique IP addresses and some country information linked to recent hacking attempts. Sharing those indicators can help institutions look for related activity, but the reporting does not establish who operated the addresses or connect each one to a confirmed breach. Reuters
South Korea’s AI security testing is defensive policy—not evidence about the attacks
The FSC has also been expanding a supervised AI cybersecurity testing program. Its September 3 phase-two plan made 75 entities eligible, compared with 49 in phase one, and planned to select up to 15, compared with 10 in the first phase. Participating organizations were to establish substitute controls for network separation, use frontier AI and security software-as-a-service tools for security testing, and report findings and risks to the government. These are plans for defensive testing; they do not show that the same systems or methods were used by the attackers. Financial Services Commission, September 3
Rank #3
In its summary of phase-one testing, the FSC said frontier AI could analyze very large codebases in hours and search broadly for existing vulnerabilities. It also said the vulnerabilities found were not likely to cause an immediate incident given existing safeguards, while pointing to exposed-asset management, prompt patching, and stronger defenses as priorities. That describes the agency’s defensive testing findings, not a forensic conclusion about the bank incidents. Financial Services Commission’s phase-one summary
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the public evidence does—and does not—show
- Established in public statements: police are investigating attacks involving financial institutions and customer personal information; President Lee said signs of AI use had emerged in some incidents.
- Reported institution names: Shinhan and KB Kookmin were named by Reuters; Reuters also relayed Yonhap’s reports about Hana and Woori.
- Not established in the cited reporting: which AI model or tool was used, whether AI directly enabled an intrusion, who operated any tool, how the attacks were performed, the complete list of affected institutions, the final number of affected customers, and attacker attribution.
The investigation is developing, so these details may change with later police, regulator, or bank disclosures. The information described here reflects reporting and official statements available through October 6, 2026.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
