Loading story…
South Korean President Lee Jae Myung ordered a thorough investigation into recent data breaches at financial and public institutions after receiving a briefing on the incidents and their responses. The Financial Services Commission held an emergency meeting, confirming a data compromise at Shinhan Bank and incidents affecting other banks, including KB Kookmin Bank. Local media reported exposure of data belonging to 25,000 Shinhan customers and credit card information belonging to 119,000 Kookmin customers, while Hana Bank reportedly suffered a limited breach of its sales support system.
Authorities launched on-site investigations and ordered financial companies to review externally accessible systems, authentication, access controls, and unnecessary information exposure, alongside coordinated threat-information sharing. Yonhap reported that a server used in the attacks had an HTML page title containing Chinese-language text associated with ARTEX AI, an open-source, AI-agent-based penetration-testing system. Neither the banks nor financial authorities have confirmed AI involvement, and the Chinese-language text does not establish attribution to any particular threat actor.
See the actors and campaigns active against you right now.
12 events from the most recent confirmed update back to the earliest known activity.
South Korea’s National Office of Investigation announced Tuesday that it had created a 28-person team to investigate breaches reportedly affecting at least seven financial institutions and exposing at least 68,000 people’s personal data. Financial authorities also reportedly identified 33 IP addresses linked to at least 12 countries, which do not establish the attackers’ identities or national origins.
On Sunday, President Lee Jae Myung ordered a thorough investigation into recent data breaches affecting financial institutions, including local banks. Cheong Wa Dae said he had received a briefing on breaches at financial and public institutions and their responses.
The reported financial-sector breaches also affected 11 outsourced developers at BNK Busan Bank and 146 housing loan agents at Hyundai Capital. Neither institution's breach date is specified.
Yegaram Savings Bank reported that 40,000 customers were affected by the attacks on South Korean financial institutions. The reference does not specify when its breach occurred or what customer information was exposed.
Yonhap News Agency reported that Woori Bank also experienced a data leak, adding another reported victim to the South Korean financial-sector incidents. The reference does not specify the affected customer count or types of exposed data.
During a livestreamed cabinet meeting, President Lee Jae Myung said there were signs that hackers used AI models in the attacks on South Korean banks and warned that AI could enable hacking without specialized skills. He instructed his cabinet to establish the circumstances and minimize damage; the report did not identify the perpetrators or AI models used.
Yonhap reported that a server used in the attacks had an HTML page title containing Chinese-language text associated with ARTEX AI, an open-source AI-agent-based penetration-testing system. Banks and financial authorities had not confirmed the tool's use, and the text did not establish attribution to a particular threat actor.
South Korean authorities launched on-site investigations after receiving incident reports. They also shared relevant information with responsible institutions, including KISA.
South Korea's Financial Services Commission convened an emergency meeting following the attacks and confirmed incidents at Shinhan Bank and other banks. Financial companies were instructed to review externally accessible systems, information exposure, authentication and access controls, submit review results, and coordinate threat-information sharing.
Hana Bank suffered a limited security breach involving its sales support system. The reference did not specify the number of affected customers or the data exposed.
Officials reported a cybersecurity incident affecting KB Kookmin Bank. According to local media, credit card information belonging to 119,000 customers was exposed.
Shinhan Bank suffered a data compromise that officials subsequently confirmed at an emergency Financial Services Commission meeting. Local media reported that data belonging to 25,000 customers was exposed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
7 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcebankinfosecurity.com
Open sourcetherecord.media
Open sourcecysecurity.news
Open sourcetomshardware.com
Open sourcemkd-cirt.mk
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
South Korea faced repeated large-scale cyberattacks that disrupted banks, broadcasters, and government-facing online services, with incidents ranging from distributed denial-of-service activity against public websites to destructive attacks that knocked out internal computer networks. In one wave, attackers targeted major South Korean institutions including a leading bank, a national newspaper, and the country’s intelligence service, while related attacks also hit U.S. government websites such as the White House, Pentagon, and State Department. Officials described those operations as primarily disruptive to public-facing services rather than breaches of internal systems. In a later major incident, computer networks at broadcasters **KBS**, **MBC**, and **YTN**, along with **Shinhan Bank** and **Nonghyup**, were crippled, interrupting ATMs, payment terminals, and mobile banking even as television broadcasts remained on air. South Korean authorities raised cyber alert levels, sent investigative teams, and increased military cyber readiness amid heightened regional tensions and longstanding concern over North Korea’s cyber capabilities, though officials said attribution remained unconfirmed and warned that identifying the true source could take months; some compromised machines reportedly displayed messages from a group calling itself **"WhoisTeam."**
Jun 29, 2026
An attacker abused **ARTEX**, a China-developed agentic penetration-testing framework, to compromise peripheral internet-facing applications at multiple South Korean financial institutions and steal personally identifiable information belonging to approximately **67,000 individuals**. Zscaler ThreatLabz first observed the campaign in late September 2026. ARTEX coordinated multiple large language model backends to automate reconnaissance and exploitation of SQL injection and authentication-bypass vulnerabilities. Stolen records included names, telephone numbers, annual income figures, and loan limits. ThreatLabz assessed with **moderate confidence** that the attacker was Chinese-speaking and financially motivated. The actor separately used Claude Code to seek advice on monetizing the stolen information; the reporting does not establish that any sale occurred. Following public disclosure of the abuse, ARTEX’s developer made the project closed source, although previously downloaded copies and forks may remain available. The campaign highlights the need for financial institutions to prioritize security testing and remediation of internet-facing peripheral applications, particularly SQL injection and authentication weaknesses.
Oct 16, 2026
South Korean authorities attributed Coupang’s large-scale customer data leak to **management and security control failures**, not a sophisticated external cyberattack. Investigators said a **former Coupang engineer** who knew about weaknesses in the company’s authentication process gained unauthorized access beginning in April (after an earlier attempt in January) and maintained access until November, exploiting authentication vulnerabilities to access user accounts without proper login. Officials urged Coupang to remediate security weaknesses and asked police to investigate allegations that Coupang deleted some data despite an order to preserve it; Coupang said it is strengthening safeguards and claimed there was no evidence other parties accessed or viewed the data, and that the exposed data did not include payment or login information. The incident affected roughly **33.7–34 million** customers, with exposed data reported to include **names, email addresses, phone numbers, shipping addresses, and some order history**. The breach has escalated into a cross-border legal and political dispute: multiple **U.S. investment firms** (including Greenoaks, Altimeter, Abrams Capital, Durable Capital Partners, and Foxhaven Asset Management) filed notices seeking **investor–state dispute settlement (ISDS)** arbitration under the **Korea–U.S. Free Trade Agreement**, alleging South Korea’s investigation and enforcement actions were discriminatory and unusually severe compared with other domestic breach cases; reported measures included threats of major fines, operational suspension, and executive travel bans.
Jun 29, 2026