AI Agents Hack South Korean Banks, Exposing Personal Data of 68,000 Customers
What Happened — South Korean officials say AI‑driven agents, believed to be the Chinese tool Artex AI, were used to breach the systems of at least seven banks, including Hana Bank, KB Kookmin Bank and Shinhan Bank. The attacks exposed personal data—names, phone numbers, borrowing history and incomes—of roughly 68 000 customers. Investigators have traced 33 IP addresses to multiple countries.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for AI‑governance controls that continuously monitor and assess third‑party AI tools.
- Highlights the importance of mapping AI‑related risk controls to a common control spine for defensible audit evidence.
- Shows that without continuous evidence collection, emerging AI‑powered attack vectors can bypass traditional security checks.
Who Is Affected — Financial services (banks) in South Korea; potentially any organization that integrates external AI tools without robust oversight.
Recommended Actions
- Conduct a formal AI‑tool risk assessment and integrate AI governance into your continuous monitoring program.
- Map AI‑related controls to your framework of record (e.g., NIST AI RMF) and collect evidence for audit readiness.
- Review third‑party AI vendor contracts for security obligations and incident‑response clauses.
Source: The Record
Technical Notes — The attacks leveraged AI agents to automate credential‑guessing and lateral movement; no specific CVE was disclosed. Exfiltrated data included customer borrowing histories, incomes, phone numbers and names.