AI Tools Used in Data Breaches at South Korean Banks, CrowdStrike Reports

What is known about the attacks

CrowdStrike has reported that a suspected Chinese-speaking hacker used artificial intelligence (AI) tools to breach several South Korean financial organisations. The campaign ran from late September to early October 2026. According to Infosecurity Magazine↗ (opens in a new tab), the attacker used an open-source tool called ARTEX, developed in China, alongside Anthropic’s Claude AI model. The attacks led to data being stolen from at least two banks: Shinhan Bank and Yegaram Savings Bank.

The South Korean Financial Services Commission (FSC) issued a consumer alert on 6 October, warning customers of the affected banks to be careful about possible phishing attacks and loan scams. The banks are still investigating the full extent of the breaches.

How the attacker used AI

CrowdStrike says the hacker used ARTEX to find weaknesses in the banks’ systems and break into specific services. The attacker also used Claude, a large language model (LLM), to help find Telegram groups where stolen data could be sold. The researchers found that the attacker’s infrastructure included several AI models: DeepSeek v4.1-flash was the main backend, with extra sessions using GLM-5.3 (from Zhipu AI) and Grok 4.6.

Evidence for the attack came from an IP address hosting an ARTEX instance and open directories. These directories contained prompts in Chinese for pentesting (security testing) and session histories from Claude. One session included a Telegram username and a location in Guangdong, China, which CrowdStrike believes likely belong to the attacker.

What was stolen and who is affected

According to The Straits Times (as cited by Infosecurity Magazine), Shinhan Bank reported a breach affecting 25,000 people, and Yegaram Savings Bank reported 40,000 affected. At one bank, the attacker broke into a loan progress inquiry service used by brokers. At another, an employee mobile work-support system was compromised. The total number of affected organisations is not yet confirmed. The FSC has warned customers to be alert for follow-up scams.

What the banks and authorities have said

The South Korean FSC has told customers to watch out for phishing and loan scams following the breaches. The affected banks are continuing their investigations and have said they will provide updates as they learn more. CrowdStrike published its findings on 7 October, noting that the use of AI tools allowed the attacker to carry out several intrusions quickly.

What happens next and what you should do

The investigation is ongoing, and the full scale of the breach is still unclear. Customers of the affected banks should be wary of unexpected messages, especially those asking for personal or financial information. Phishing attacks often follow data breaches, as attackers use stolen data to make their scams more convincing. The banks and authorities are expected to release more information as their investigations continue.

Practical advice

• If you are a customer of Shinhan Bank or Yegaram Savings Bank, be extra cautious with emails, texts, or calls about your account.
• Do not click on suspicious links or provide personal information unless you are sure the request is genuine.
• Watch for updates from your bank and the FSC about the breach.

Context: AI in cyber attacks

This incident shows how attackers are starting to use AI tools to automate parts of their campaigns. Large language models like Claude can help attackers find vulnerabilities, automate tasks, and even find places to sell stolen data. Defenders will need to adapt as these tools become more common in real-world attacks.