ARTEX bank breaches put side-door data access on the CDO's desk

On 7 October, CrowdStrike published its analysis of a campaign against South Korean lenders. According to Cyber Magazine, a suspected attacker used China-developed, open-source agentic penetration-testing tool ARTEX alongside Anthropic's Claude Code. That is software that uses AI agentsAI agentsAgentic AI refers to AI systems that pursue goals autonomously by planning, taking actions through tools, and adapting based on results, with minimal step-by-step human direction.View full definition → to probe systems for weaknesses by itself. The ARTEX instance used DeepSeek v4.1-flash as the primary backend, supplemented by GLM-5.3 from Z.ai and Grok 4.6 of SpaceXAI.

The Korea Times counted seven financial firms reporting leaks, including Shinhan Bank, KB Kookmin Bank and Hana Bank, along with Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital. More than 67,000 people are believed to have been affected. According to UPI, Shinhan's information belonging to about 25,000 customers was exposed through unauthorized access to a service associated with loan brokers, including names, telephone numbers, annual income and loan limits.

Data leaders should pay attention to how the attackers got in. UPI reported that attackers appeared to focus on externally connected support and lookup systems rather than core financial networks. The Korea Times noted that the three largest banks together spent nearly 124 billion won ($92 million) on information security last year. The Financial Services Commission's response, according to Herald Business, was to tell firms to examine every externally accessible system, regardless of whether it serves customers.

The role of AI is disputed. American Banker wrote that the attackers took advantage of what appear to be ordinary cyber hygiene failures rather than complex vulnerabilities, and a Financial Security Institute official said the AI "did not act independently without human involvement". The same outlet reported that one bank had given the recruiters, who are not bank employees, access to sensitive customer credit data, which critics called excessive. On the other side, CrowdStrike's Adam Meyers argues adversaries are "operationalising agentic AIagentic AIAgentic AI refers to AI systems that pursue goals autonomously by planning, taking actions through tools, and adapting based on results, with minimal step-by-step human direction.View full definition → to move faster".

What to watch next: the final count, since the number of banks affected by the attacks is not yet confirmed, and follow-on fraud. FSC Chairman Lee Eog-weon warned that regulators "cannot rule out the possibility of secondary damage, such as voice phishing and smishing using the leaked data."