South Korean financial breaches highlight access-control gaps

What the regulator confirmed

South Korea’s Financial Services Commission (FSC) said cyberattacks against KB Kookmin Bank and other major financial companies followed the September 30 information leak at Shinhan Bank and caused further damage. Its October 2 statement did not give a total count of affected firms or quantify that additional damage. The FSC said authorities began onsite investigations after incident reports and shared threat information, including attacker IPs and attack types, with relevant agencies such as the Korea Internet & Security Agency (KISA). (FSC, October 2)

What October 4 reports described

Seoul Economic Daily and ChosunBiz reported that intrusions had been confirmed at seven firms: Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital. The reports described leaks through auxiliary services used by employees or loan brokers. Examples included information lookup systems that returned loan or company data without identity checks, employee systems lacking effective mobile-device controls, and web services left vulnerable to known flaws. Both outlets reported that internet and mobile banking were not disrupted and that no monetary losses had been reported at publication time. Those details come from the October 4 reporting, not the FSC statement. (Seoul Economic Daily, October 4; ChosunBiz, October 4)

Yonhap separately reported that the Shinhan incident affected about 25,000 customers, exposing names, phone numbers and annual income, and that personal information of 89 Hana customers was found exposed. Those are bank-specific details reported on October 4; the FSC statement does not provide those figures or data fields. (Yonhap, October 4)

The controls regulators requested

The FSC asked financial firms to inventory externally reachable IT assets and services, review authentication and access controls, reduce unnecessary information exposure, and block unauthenticated paths to internal data. It also called for rapid sharing of IPs, attack methods and attempted-intrusion information. The commission said it would oversee consumer protection and compensation by firms that suffered incidents; this describes its planned oversight, not proof of any financial loss. (FSC, October 2)

October 7: CrowdStrike reports an ARTEX campaign

CrowdStrike reported that a campaign active from late September to early October targeted South Korean financial organizations and resulted in data exfiltration. Analysis of attacker-controlled open directories found ARTEX configuration files, Claude Code session histories and Claude memory files. CrowdStrike says the targets overlap with organizations in industry reporting, but the number of affected organizations remains unconfirmed. It assesses with moderate confidence that the unidentified actor was likely Chinese-speaking and financially motivated; it does not name an adversary.

CrowdStrike identifies DeepSeek v4.1-flash as the ARTEX instance’s primary LLM backend. It also found GLM-5.3 and Grok 4.6 in additional Claude Code sessions. The report does not say that Anthropic’s Claude model powered the ARTEX instance.

October 8: ARTEX author ends public releases

In a separate statement, ARTEX author Autumn-27 said the project would stop receiving updates, become closed source, and have no further public versions or maintenance support because of misuse. The statement does not name the South Korean campaign or connect ARTEX to a specific bank incident. It also does not say that existing copies have been disabled.

October 14: regulator sets a wider count

The FSC said recent data-breach incidents had been confirmed at 16 financial companies across the sector. It estimated that about 100,000 pieces of customer data were involved, including names, contact information, resident registration numbers and email addresses. This is a count of data items, not a stated count of people. The FSC said no breach involving account passwords or credit-card numbers had been reported to date. (FSC, October 14)

Investigators were still examining whether the incidents were connected, traced to a common attacker, or involved AI. The regulator did not attribute all 16 incidents to AI or to one campaign. The FSC also reported that all 555 financial companies completed a 12-point self-evaluation, with 130 reporting areas for improvement, mostly patches or control systems. It outlined plans for broader inspections, faster incident reporting and sharing, a regulatory basis for more frequent vulnerability testing, and more support for smaller financial companies. The checklist findings are company self-reports, and the inspections and policy measures were plans at the time of the statement. (FSC, October 14)