South Korean authorities widened their investigation into cyberattacks on financial companies after President Lee Jae Myung said artificial intelligence may have been used in some incidents. Police assigned a 28-member team to examine the attacks and possible breaches of the information and communications network law. The incidents exposed customer information at seven financial companies, according to Yonhap. Officials have not disclosed which AI tools may have been used or the full scale of the breaches.
The latest disclosures add a new investigative strand to the financial-sector response ordered earlier in October. Shinhan Bank, KB Kookmin Bank and Hana Bank were among the institutions identified by authorities and local reporting. Reuters said Woori Bank was also reported to have suffered a breach. The Financial Supervisory Service and the Financial Security Institute shared 28 suspect internet-protocol addresses and related country information with financial firms.
AI USE REMAINS UNDER INVESTIGATION
Lee said signs had emerged that AI was possibly involved in some hacking cases, but neither the government nor investigators described the models, agents or techniques in question. That distinction matters because the current evidence supports an investigation into possible AI use, not a confirmed attribution. The president asked authorities to establish the circumstances quickly and devote personnel and resources to limiting damage.
The police team is investigating the attacks across the affected companies rather than treating them as isolated bank incidents. Regulators had already convened industry associations, supervisors and executives from affected institutions. The additional technical indicators circulated by supervisors may help firms compare attempts and determine whether the breaches shared infrastructure or methods.
BANKS FACE FURTHER DISCLOSURE TESTS
The investigation places pressure on affected banks to identify compromised systems, notify customers where required and demonstrate that containment measures are working. It also raises a broader supervisory question about whether existing controls can detect automated probing or other AI-assisted attacks. Authorities have not yet established the extent of any common vulnerability across the institutions.
The next milestones are the police findings, a verified account of how AI may have been used and fuller disclosure of the customer impact at each institution. Supervisors will also need to determine whether the 28 suspect addresses connect the attacks. Until those findings are available, attribution and the scale of the incident remain provisional.