South Korea’s President Lee Jae Myung said at a Cabinet meeting on Tuesday 6 October that “In some hacking cases, details have emerged of the possible use of artificial intelligence (AI)”, in Yonhap’s English translation, after customer information was exposed at seven financial companies. Korean newspapers that quoted him also report him saying that AI has made it possible to hack easily without special ability.
In the nine documents read, no AI tool, model or developer is named.
Business Pill · EVERY DOOR COUNTS
A one-minute explainer of the idea behind this story: an attack surface. It teaches the concept, not this story’s figures.
The key insight: Two things sit side by side in the reports read: the President’s remark that details of the possible use of AI have emerged in some hacking cases, and Sports Hankook’s account that, at the major banks where leaks were confirmed, the route of attack was business-support services such as a loan-recruiter inquiry service, an employee mobile work-support system and a sales-support system. This publication sets them next to each other as the reports state them and does not connect them.
Update, 26 October: GMO Pays Every User ¥5,000 and Covers Fraudulent-Trade Losses
GMO Internet will pay a uniform ¥5,000 goodwill payment to all users, whether or not they suffered financial damage, and will compensate losses and fees from unauthorized trades, Jiji Press reported on 24 October. The servers that may have been affected by the unauthorized access number 26,739, and GMO will tell users how to apply by email by 6 November.
Chief executive Masatoshi Kumagai announced the payments in a blog post, Reuters reported, which put the payment at about $32. GMO will also offer a free alternative service for six months, said it would not comply with a demand for money accompanied by a threat to disclose company and customer information, and is working with police and other authorities, and said it could not yet calculate the impact on earnings. GMO shares fell almost 16% to a four-month low, Reuters reported.
GMO is not alone: Park24, which runs Times car-sharing, said it would make ¥3,000 payments to customers after a personal data breach last month and expects an extraordinary loss of ¥5.5 billion, Reuters reported. Neither report links the payments to the Artex tool described above.
Update (25 Oct): the same tool is now linked to attacks in Japan. GMO Cybersecurity by Ierae, a subsidiary of GMO Internet Group, said on 20 October that a Chinese AI-powered penetration-testing tool called Artex was likely used in a wave of cyberattacks on Japanese companies. It traced the attacks to six servers, all using Artex, aimed at financial and logistics firms, eight of which disclosed information breaches between September and October, Jiji Press reported. Jiji added that Artex is believed to have been used against financial institutions in South Korea as well.
Artex’s developer has said the tool was built for defensive security testing and that using it for attacks was “entirely contrary to” its intentions, and it has stopped updating the project, the Korea Times reported. GMO’s finding is an attribution to a tool, not to a named group or state.
Update (25 Oct): GMO’s CEO on the Artex attacks. GMO Internet Group chief executive Masatoshi Kumagai wrote that “the internet itself is on the verge of collapse,” according to an English translation of a statement shown in a post by Andrew Curran on X. In it, Kumagai wrote that GMO Cybersecurity by Ierae “has confirmed that the source of attacks targeting approximately 20 Japanese companies was the autonomous AI penetration testing tool “ARTEX,” which is originally intended for defense, being misused.” Kumagai added that “the threat has escalated at an unprecedented pace in just over a year.”
Posts on X add claims we could not confirm from GMO. Curran wrote that a GMO cloud VPS service used by foreign-exchange traders was hacked and that attackers executed trades “across over 70 brokerages.” Choblin (@choblin29) wrote that the breach exposed up to 26,739 servers and trading accounts and that GMO asked Japan to apply its Active Cyber Defense law; Japan put that program into operation on 1 October, Jiji reported. The screenshot does not show where or when Kumagai’s statement was published.
Yonhap reports that Lee gave the order at a Cabinet meeting “in response to revelations that the attacks exposed customer information at seven companies, including Hana Bank, KB Kookmin Bank and Shinhan Bank”. It quotes him: “In some hacking cases, details have emerged of the possible use of artificial intelligence (AI), causing the people to feel great concern and anxiety.” It continues: “Please carry out a swift and clear determination of the circumstances and concentrate personnel and resources on minimizing damage.”
Seoul Shinmun gives the Korean sentence as “ํนํ ์ผ๋ถ ํดํน์ ๊ฒฝ์ฐ์๋ ์ธ๊ณต์ง๋ฅ์ด ํ์ฉ๋ ์ ํฉ๋ ๋๋ฌ๋ ๊ตญ๋ฏผ๋ค์ ์ฐ๋ ค์ ๋ถ์์ด ๋งค์ฐ ํฌ๋ค”. The sentence uses the word ์ ํฉ, which Yonhap’s English renders as “details” of “possible use”. The sentence does not name a tool, a model or a company.
Seoul Shinmun and Asia Economy also quote a sentence that Yonhap’s English report does not carry. Seoul Shinmun’s text reads “์ด์ ์ธ๊ณต์ง๋ฅ์ ํ์ฉํด ํน๋ณํ ๋ฅ๋ ฅ์ด ์๋ ๊ฒฝ์ฐ์๋ ํดํน์ ์ฝ๊ฒ ํ ์ ์๋ ์ํฉ์ด ๋์๋ค”; Asia Economy quotes it with minor wording differences. This publication’s translation is that it has now become possible, using AI, to hack easily even without special ability.
Yonhap quotes Lee on the response: “It is difficult to respond to evolving cyber threats by handling accidents after they happen.” He added: “We must have the security capabilities to detect and block attacks in advance.” Yonhap says he “particularly called for accelerated efforts to develop and adopt AI tools tailored for cyber security”, and describes him as saying that AI-driven hacking methods are increasing the scope of damage to previously unseen levels.
Who said what, and when, as Yonhap and the Korean newspapers report it, from the Thursday before 4 October to 6 October 2026. The statements are the named bodies’; this publication verified none of it.
What Was Posted on X
HOLY. GMO Internet Group CEO Masatoshi Kumagai says: ‘Right now, the internet itself is starting to break.’
‘In fact, an investigation by our group’s GMO Cybersecurity by Ierae has confirmed that at the source of unauthorized access targeting roughly 20 Japanese companies, ‘ARTEX,’ an autonomous AI penetration-testing tool originally meant for defense, was being abused.’
The breach exposed up to 26,739 servers and trading accounts across 70+ brokerages and FX firms. GMO has asked Japan to apply its new Active Cyber Defense law, in force since October 1.
‘We have already entered an era where, with just simple instructions, AI searches for weaknesses and runs all the way to intrusion on its own.’
Choblin (@choblin29) quotes GMO Internet Group CEO Masatoshi Kumagai: “Right now, the internet itself is starting to break,” and quotes Kumagai saying GMO Cybersecurity by Ierae confirmed that the autonomous AI penetration-testing tool ARTEX was abused at the source of unauthorized access targeting roughly 20 Japanese companies. The post also cites figures of its own: up to 26,739 servers and trading accounts across 70+ brokerages and FX firms.
JUST IN: Japanese internet giant GMO announces $32 cash payments to all customers following a major cyberattack.
Polymarket posted on 26 October that Japanese internet giant GMO announced $32 cash payments to all customers following a major cyberattack.
What the Banks and Authorities Said First
On Sunday 4 October, Yonhap quotes presidential spokesperson Kang Yu-jung from a press release: “President Lee was briefed on the recent data breaches at financial and public institutions and the measures taken in response.” She added that he “instructed authorities to take the matter seriously, conduct a thorough investigation and spare no effort in coming up with measures to address the issue”.
The same Yonhap report says: “On Thursday, Shinhan Bank said personal information of around 25,000 customers, including their names, phone numbers and annual income, had been leaked.” It continues: “Sources said the bank was attacked by hackers who utilized advanced artificial intelligence (AI) tools.” The report does not name those sources or any tool, and this publication could not check the claim.
Yonhap also says: “Personal information of 89 customers was found to have been leaked from Hana Bank, while Woori Bank and NH Nonghyup Bank were also targeted in similar hacking attempts, though no personal information was leaked as the banks blocked unauthorized access to their systems.”
Financial Services Commission Chairman Lee Eog-weon held an emergency meeting with the heads of the affected firms, with Financial Supervisory Service governor Lee Chan-jin. Yonhap quotes him: “We have detected multiple security breaches across various sectors in a short span of time, not only at major commercial banks but also at savings banks and specialized credit finance firms.” It says he told the meeting that no sensitive information that could be used for unauthorized payments appeared to have been leaked so far, warned that the leaked information could still be exploited for voice phishing or other scams, and “did not rule out the possibility that AI tools were used in the hacking attacks”.
Which Firms and Which Systems
Sports Hankook, citing financial authorities and the industry on 6 October, says leaks or signs of exposure were confirmed at several financial firms, naming Shinhan, KB Kookmin, Hana and BNK Busan banks, Yegaram and Welcome savings banks and Hyundai Capital among them, and says Woori Bank and NH Nonghyup Bank saw attempts by outside unauthorised parties.
It writes that, at the banks where leaks were confirmed, business-support services were used as the route of attack. For Shinhan Bank it reports abnormal access through an inquiry service for loan recruiters and others, with about 25,000 customers’ information leaked, including names, phone numbers, annual income and calculated loan limits, and some resident registration numbers and linkage information. For KB Kookmin Bank it reports 119 customers’ personal information leaked through an employee mobile work-support system. For Hana Bank it reports 89 customers’ information leaked through abnormal access to a sales-support system.
Sports Hankook says the financial authorities widened their checks to external web pages used by employees, loan recruiters and contractors, and asked firms to verify authentication, access control, information-query permissions and anomaly detection. It also writes that it has not been confirmed whether the attack targets and the security measures applied were the same at each bank.
What the Police and the Prime Minister Said
On 6 October, Yonhap reports that the National Office of Investigation formed a 28-member team to investigate on suspicion of violations of the information and communications network law. It quotes the office: “(We) will carry out an investigation swiftly and strictly while closely cooperating with relevant agencies to ease the public’s anxiety.” Seoul Shinmun says the team has four units under the head of the cyber terror response division, and that the office is reviewing whether the case should go to the new Serious Crime Investigation Agency.
The same day Yonhap quotes Prime Minister Han Seong-sook, speaking at a meeting she presided over with related ministers: “This is a serious situation because this incident is believed to have taken advantage of artificial intelligence, and if AI is used in phishing attacks, it could lead to secondary damage.” She also told the police to mobilise all available capabilities, and urged financial authorities to ensure that affected institutions provide proper customer protection measures and compensation.
The Structural Read
The President’s two Korean sentences make different points. Seoul Shinmun quotes one about circumstances in which AI was used having come to light in some cases. It quotes another, which Yonhap’s English report does not carry, about AI making it possible to hack easily without special ability.
Sports Hankook writes that, at the major banks where leaks were confirmed, business-support services were used as the route of attack, and that the financial authorities widened their checks to external web pages used by employees, loan recruiters and contractors. None of the nine documents read says how AI was used in those cases.
The statements come from different bodies on different days: Shinhan Bank on the Thursday before 4 October, the financial watchdog’s chair on 4 October, and the police, the Prime Minister and the President on 6 October. In Yonhap’s English, the wording of the AI statements ranges from “did not rule out” to “is believed to have taken advantage of” to “details have emerged of the possible use”.
President Lee Jae Myung, in Yonhap’s translation
“In some hacking cases, details have emerged of the possible use of artificial intelligence (AI), causing the people to feel great concern and anxiety.”
Three Implications
THE WORDS ARE HEDGED AT EVERY LEVEL In Yonhap’s English, the financial watchdog’s chair did not rule out AI use, the Prime Minister said the incident is believed to have taken advantage of AI, and the President cited details of possible use. In the nine documents read, none names a tool, a model or a developer.
THE ROUTE DESCRIBED IS BUSINESS SUPPORT Sports Hankook describes entry through a loan-recruiter inquiry service, an employee mobile work-support system and a sales-support system, and says the authorities widened checks to external pages used by staff, recruiters and contractors. It writes that it is not confirmed whether the attack targets and security measures were the same at each bank.
WHAT REMAINS OPEN The official transcript of the Cabinet meeting, the banks’ own notices and the regulators’ own releases were not read, and, among the documents read, the KB Kookmin figure of 119 customers appears only in Sports Hankook. This publication draws no conclusion about whether AI was used or about who carried out the attacks.
What Is Not Established
The President’s words are given as Yonhap and the Korean newspapers quote them. This publication did not read an official transcript of the Cabinet meeting from the Presidential Office, and it did not read the banks’ own notices or the financial authorities’ own releases; their statements are read through Yonhap and Sports Hankook. Among the nine documents read, the KB Kookmin figure of 119 customers appears only in Sports Hankook.
In the nine documents read, no AI tool, model or developer is named, and none says how AI was used. This publication draws no conclusion about whether AI was used, about who carried out the attacks, or about any bank. It did not contact the Presidential Office, the police, the Financial Services Commission or any bank.
Business Engineer Framework
The Map of AI — The Stack Beneath the Applications
The Map of AI places more than 200 companies across nine layers of the stack, from silicon to application. It shows the layers that sit beneath the applications people use every day.
At a Cabinet meeting on 6 October, President Lee said, in Yonhap’s translation, that in some hacking cases “details have emerged of the possible use of artificial intelligence”. At a separate meeting with ministers that day, Prime Minister Han Seong-sook said the incident “is believed to have taken advantage of artificial intelligence”. The police have formed a 28-member team, and Sports Hankook reports that, at the major banks where leaks were confirmed, business-support services were used as the route of attack.
All of it is the named bodies’ statements as Yonhap and the Korean newspapers report them; this publication verified none of it independently.
A note on sourcing. We drew this piece from Yonhap’s English-language reports of 3, 4, and 6 October 2026 and from Korean reports by Seoul Shinmun, Asia Economy, and Sports Hankook of 6 October 2026, all read in full. We did not obtain an official Cabinet-meeting transcript, the banks’ own notices, or regulators’ own releases, and we have not checked any of these claims independently. None of the nine documents we read names an AI tool, model, or developer, and we draw no conclusion about whether AI was actually used. Nothing here is a forecast or advice.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
Scroll to Top
Discover more from FourWeekMBA
Subscribe now to keep reading and get access to the full archive.
