On October 7, 2026, US security firm CrowdStrike published an analysis of attacks on Korean financial companies. Between late September and early October, customer data leaked from several financial firms in South Korea. CrowdStrike concluded that the attacker used an AI agent to break into multiple targets in a short time. But the two victim systems CrowdStrike described were not customer banking apps. One was a status-lookup service used by loan brokers. The other was a mobile work-support system for employees.
The attacker left AI work logs in a server folder anyone could open, and CrowdStrike got hold of them
The material CrowdStrike analyzed sat in a public directory on a server the attacker controlled, meaning a folder set up so anyone could browse it. The folder still held Claude Code session logs, configuration files for an AI agent called ARTEX, and the memory files Claude uses to keep track of its work. CrowdStrike started from Korean news reports, found these traces, and checked whether the targets named in the logs matched victims known in the industry. Its public write-up does not say whether it saw the victims' internal logs.
The logs also covered what happened after the break-ins. The attacker asked Claude where data leaked from South Korea is usually sold. In another session, the attacker asked Claude to write a “security researcher résumé” featuring the results of this campaign, and supplied personal details such as a name and contact information. CrowdStrike wrote that these details likely belong to the attacker but could not confirm it. Everything from the intrusions to asking where to sell the data happened in the same AI workspace, and those records became the trail back to the attacker.
CrowdStrike put it this way in its conclusion:
“AI tooling can enable a financially motivated threat actor to conduct multiple intrusions within a short time span.”
In the same post, however, CrowdStrike wrote that the number of affected organizations is unconfirmed, and said it holds only moderate confidence that the attacker is a Chinese speaker driven by money. CrowdStrike sells threat intelligence products, and this analysis ends with an invitation to request a demo.
The attacker ran a two-month-old free tool on other companies' commercial AI models and went after financial firms indiscriminately
ARTEX is an open-source agent released on GitHub on July 26. It uses AI to automate penetration testing, where you deliberately try to break into a system to find weak spots. On September 3, it took first place overall among about 150 teams in a Baidu competition where AI security agents faced off in attack and defense. A new version came out on September 24, and three days later, on September 27, the attack on Kookmin Bank began.
ARTEX has no AI model of its own. It only runs when connected to an outside commercial model such as ChatGPT, Claude, or DeepSeek. The configuration CrowdStrike recovered shows that the main model the attacker connected to ARTEX was DeepSeek v4.1-flash, reached not through DeepSeek's official service but through what appears to be a reseller of access. Separately from ARTEX, the attacker also used Claude Code, Anthropic's AI coding tool, and in some Claude Code sessions used Zhipu AI's GLM-5.3 and xAI's Grok 4.6 as secondary models. Every AI used in the attack was a commercial model that companies already offer as a service.
CrowdStrike's Adam Meyers told Reuters the incident was an attack by a human threat actor using AI agents, and that with AI's help a single person can target many victims in a very short time. Korean authorities likewise see this not as an attack aimed at chosen companies, but as AI-driven attempts against many financial firms at once, with the weakly defended ones getting breached. The head of the Financial Security Institute said the attacks on the banks came from nearly the same IP addresses, while those on savings banks were slightly different. There is no official confirmation yet that every victim was hit by the same attacker with the same tool.
A human was in charge. An official at the Financial Security Institute said the AI in this attack did not act on its own without human involvement. The outlet Forkast also concluded that AI intrusions today are led by people, with AI serving to scale up the attack.
The way in was not a newly found flaw but old gaps, like weak identity checks left in work systems
In an October 4 press briefing, the Financial Services Commission named “systems used by outside personnel such as loan brokers and contractors, and by employees” as where the recent breaches occurred. Both systems CrowdStrike described fall within that scope. At Shinhan Bank, a lookup site used not by bank staff but by outside loan brokers was breached, exposing customers' names, contact details, annual incomes, and loan limits. Internet and mobile banking and the core network that handles accounts and transactions were not breached, and no passwords or OTPs leaked. No cases of customers losing money have been confirmed.
American Banker wrote that the attackers exploited what looked like ordinary security management failures rather than complex vulnerabilities. On Shinhan Bank's lookup site, the mobile phone identity check was broken, and Busan Bank admitted that some of its web pages did not properly validate login sessions. American Banker also pointed to broad viewing permissions granted to outside personnel. Nothing published so far points to a new security flaw discovered in this attack. NAJAM US SAQIB, writing on the developer blog Dev Genius, titled a piece on the case “The AI agent was the cheapest part of the Korean bank hack.” Park Chan-am, CEO of security firm Stealien, said core financial systems held up because they use authentication beyond IDs and passwords, and that this kind of attack worked here because the targets were peripheral systems.
The most widely cited damage figure is “at least seven financial firms and 68,000 people,” reported by the Wall Street Journal citing officials. That number does not appear in the Financial Services Commission's own release. CrowdStrike did not name the victims, and Korean authorities have not officially named ARTEX. Below are the per-company leak figures reported in Korean media, and how much public evidence ties each company to the AI tool.
| Company | Reported leak size | Public evidence linking it to the AI tool |
|---|---|---|
| Shinhan Bank | 25,727 customers | Same type of system as the loan-broker status-lookup service CrowdStrike described without naming it |
| Kookmin Bank | 119 people (99 customers, 20 current and former employees) | Report that the attack began three days after the latest ARTEX release (Kyunghyang) |
| Hana Bank | 89 people | No company-specific evidence of an AI link published |
| Busan Bank | 11 outsourced developers | No company-specific evidence of an AI link published |
| Welcome Savings Bank | Up to 2,200 corporate customer records | No company-specific evidence of an AI link published |
| Hyundai Capital | Some of 146 loan brokers | No company-specific evidence of an AI link published |
| Yegaram Savings Bank | About 40,000 people | No public reporting on an AI link at all (per Reflectiz) |
The figures in the table add up to roughly 68,000, but that is a rough total mixing people, corporate customer records, and an unspecified “some” at Hyundai Capital, and it is not an official figure. The largest share, about 40,000 people at Yegaram Savings Bank, has no public reporting tying it to AI, so it is hard to count all 68,000 as victims of the AI agent attack.
Korea JoongAng Daily also reported how long three banks took to notice the breaches after they happened.
Two of the three took more than a day to notice the intrusion, and Kookmin Bank took almost three days.
Copies of the attack tool keep circulating, and regulators now sort systems by outside exposure, not by whether customers use them
After word spread that the tool had been misused, the ARTEX developer made the source private and stopped updates on October 8. The developer said they oppose illegal use and bear no responsibility for unlawful acts. The original GitHub page also said the tool was for personal learning and code research and should not be used on real online systems. But copies that had already spread remain. BleepingComputer reported that modified versions in English and Korean are still available, and Dev Genius wrote that 897 copies anyone can download remain on GitHub. An official at the Financial Security Institute also said there are a great many open-source AI tools like ARTEX. Even with the source closed, tools of the same kind are still easy to get.
On Sunday, October 4, the Financial Services Commission called heads of financial industry associations, major financial firms, and relevant ministries to an emergency review meeting at Government Complex Seoul. The commission told firms to check every IT asset exposed to the outside, whether customer-facing or not, and to block, in principle, any outside access not strictly needed for work. It ordered checks on any path where authentication could be missing or bypassed, and called for a security setup that would “defend against AI attacks with AI.” Before that, on October 1, financial authorities had shared the IP addresses used in the attacks with about 500 financial firms.
The commission drew the line for its checks not at whether customers use a system, but at whether it is open to the outside. The loan-broker lookup site and the staff mobile work system breached this time were not systems customers use directly, but outside brokers and employees did log in to them from outside.
Customer banking and core networks were not breached this time → The attacker used an agent running on commercial AI models to try many financial firms at once, and work systems for loan brokers and staff with weak identity checks gave way → That is why the Financial Services Commission now sorts systems by whether they are open to the outside, not by whether customers use them.
Further reading
CrowdStrike's original analysis The source write-up on how CrowdStrike obtained the AI work logs left on the attacker's server and what it confirmed. crowdstrike.com
The regulator's official diagnosis and response The Financial Services Commission's press briefing on what it sees as the cause and what it asked of the financial sector (in Korean). fsc.go.kr
The case that old gaps were to blame A report on the loan-broker sites, weak identity checks, and lax session validation. americanbanker.com