Financial Security Institute Warned Banks of AI Hacking Before Data Leaks
October 13, 2026 · 2 min read
The Financial Security Institute shared actual cases of AI hacking and requested countermeasures from financial companies approximately two weeks before a series of personal information leaks occurred within the domestic financial sector.
During a seminar on September 17, the Financial Security Institute introduced response plans and examples of AI agent attacks targeting domestic financial firms to about 160 security officers. Representatives from five of the seven financial companies that later suffered breaches attended the event, including KB Kookmin Bank, Hana Bank, Hyundai Capital, Welcome Savings Bank, and Shinhan Bank, which attended at the financial group level. BNK Busan Bank and Yegaram Savings Bank were the only two affected firms that did not send representatives.
The institute highlighted a September attack on a domestic financial company where an attacker used an AI agent based on the DeepSeek model to locate Oracle WebLogic servers. The attacker exploited remote command execution vulnerabilities to install a web shell, which is a malicious program allowing remote commands, to explore other internal servers. That specific company prevented further damage by detecting and blocking the attacker before additional malware could be downloaded.
Recent subsequent leaks at major firms like Shinhan Bank, KB Kookmin Bank, and Hana Bank involved different methods. Attackers reportedly automated attacks by combining AI models such as DeepSeek with an AI based penetration testing tool called ARTEX. These attacks targeted external business systems, including employee mobile applications and loan solicitor inquiry pages.
The Financial Security Institute stated that AI allows attackers to repeat sophisticated attacks across multiple institutions. It noted that attacks exploiting web application vulnerabilities are difficult to detect with existing firewalls or security monitoring systems because they resemble normal service requests. The institute previously emphasized that annual vulnerability diagnoses are insufficient and that constant inspection of business systems and servers exposed to the internet is necessary.
Representative Han Chang-min stated that the leaks resulted from a failure to manage known vulnerable points. The heads of five major commercial banks are scheduled to appear as witnesses at the Financial Supervisory Service national audit on October 19 to be questioned about the hacking incidents and their responses.