President Lee Jae Myung of South Korea says officials there are probing a series of recent bank hacks that authorities believe were likely caused by artificial intelligence agents.
The personal data of at least 68,000 people was reportedly exposed in breaches of at least seven financial institutions, with officials saying they believe the Chinese cybersecurity tool Artex AI was used to hack the banks’ systems.
Financial authorities said they have so far found 33 IP addresses used in the hacks, according to local news reports. The incidents, which first came to light on September 30, are the first known example of AI agents hacking the financial sector.
The impacted financial companies include Hana Bank, KB Kookmin Bank and Shinhan Bank, the latter of which has reportedly said personal data belonging to roughly 25,000 customers was exposed.
The breached data included details about individual customers’ borrowing history, incomes, phone numbers and names, the Korea Herald reported.
“Signs have emerged” suggesting AI agents were deployed in at least some of the attacks, Lee said Tuesday.
“It’s now become possible to use AI to hack with ease even without specialized skills,” Lee reportedly added.
Lee pledged to devote significant staff and money to “swiftly and clearly” ensure the hacks do as little damage as possible.
The National Office of Investigation said Tuesday that it has created a team of 28 investigators, according to local news reports.
The IP addresses have been linked to at least 12 countries, including Japan, the U.S., Thailand, Vietnam and Hong Kong, a Chinese territory, the country’s Financial Supervisory Service (FSS) reportedly said.
In recent weeks, reports of AI-powered hacks of governments and major companies have proliferated.
Australian officials said last month that OpenAI agents hacked its Medicare database containing personal data belonging to most of the continent’s citizens.
OpenAI came under fire after Australian officials revealed the company did not tell them about the hack until several weeks after it happened and used a generic, public-facing email address to make the notification.
The tech giant’s chief strategy officer appeared before Australia’s parliament Tuesday to apologize for the incident. The company has changed its protocols to require that organizations breached by its agents be notified quickly, citing a recent disclosure made within 48 hours of a suspected breach, he reportedly said.
In July, OpenAI disclosed that its agents were responsible for the hack of the AI platform Hugging Face.
Suzanne Smalley
is a reporter covering digital privacy, surveillance technologies and cybersecurity policy for The Record. She was previously a cybersecurity reporter at CyberScoop. Earlier in her career Suzanne covered the Boston Police Department for the Boston Globe and two presidential campaign cycles for Newsweek. She lives in Washington with her husband and three children.