Korea’s President Cites Possible AI Use in Bank Hacks

South Korea’s President Lee Jae Myung said at a Cabinet meeting on Tuesday 6 October that “In some hacking cases, details have emerged of the possible use of artificial intelligence (AI)”, in Yonhap’s English translation, after customer information was exposed at seven financial companies. Korean newspapers that quoted him also report him saying that AI has made it possible to hack easily without special ability.

In the nine documents read, no AI tool, model or developer is named.

What the President Said

Yonhap reports that Lee gave the order at a Cabinet meeting “in response to revelations that the attacks exposed customer information at seven companies, including Hana Bank, KB Kookmin Bank and Shinhan Bank”. It quotes him: “In some hacking cases, details have emerged of the possible use of artificial intelligence (AI), causing the people to feel great concern and anxiety.” It continues: “Please carry out a swift and clear determination of the circumstances and concentrate personnel and resources on minimizing damage.”

Seoul Shinmun gives the Korean sentence as “특히 일부 해킹의 경우에는 인공지능이 활용된 정황도 드러나 국민들의 우려와 불안이 매우 크다”. The sentence uses the word 정황, which Yonhap’s English renders as “details” of “possible use”. The sentence does not name a tool, a model or a company.

Seoul Shinmun and Asia Economy also quote a sentence that Yonhap’s English report does not carry. Seoul Shinmun’s text reads “이제 인공지능을 활용해 특별한 능력이 없는 경우에도 해킹을 쉽게 할 수 있는 상황이 되었다”; Asia Economy quotes it with minor wording differences. This publication’s translation is that it has now become possible, using AI, to hack easily even without special ability.

Yonhap quotes Lee on the response: “It is difficult to respond to evolving cyber threats by handling accidents after they happen.” He added: “We must have the security capabilities to detect and block attacks in advance.” Yonhap says he “particularly called for accelerated efforts to develop and adopt AI tools tailored for cyber security”, and describes him as saying that AI-driven hacking methods are increasing the scope of damage to previously unseen levels.

What the Banks and Authorities Said First

On Sunday 4 October, Yonhap quotes presidential spokesperson Kang Yu-jung from a press release: “President Lee was briefed on the recent data breaches at financial and public institutions and the measures taken in response.” She added that he “instructed authorities to take the matter seriously, conduct a thorough investigation and spare no effort in coming up with measures to address the issue”.

The same Yonhap report says: “On Thursday, Shinhan Bank said personal information of around 25,000 customers, including their names, phone numbers and annual income, had been leaked.” It continues: “Sources said the bank was attacked by hackers who utilized advanced artificial intelligence (AI) tools.” The report does not name those sources or any tool, and this publication could not check the claim.

Yonhap also says: “Personal information of 89 customers was found to have been leaked from Hana Bank, while Woori Bank and NH Nonghyup Bank were also targeted in similar hacking attempts, though no personal information was leaked as the banks blocked unauthorized access to their systems.”

Financial Services Commission Chairman Lee Eog-weon held an emergency meeting with the heads of the affected firms, with Financial Supervisory Service governor Lee Chan-jin. Yonhap quotes him: “We have detected multiple security breaches across various sectors in a short span of time, not only at major commercial banks but also at savings banks and specialized credit finance firms.” It says he told the meeting that no sensitive information that could be used for unauthorized payments appeared to have been leaked so far, warned that the leaked information could still be exploited for voice phishing or other scams, and “did not rule out the possibility that AI tools were used in the hacking attacks”.

Which Firms and Which Systems

Sports Hankook, citing financial authorities and the industry on 6 October, says leaks or signs of exposure were confirmed at several financial firms, naming Shinhan, KB Kookmin, Hana and BNK Busan banks, Yegaram and Welcome savings banks and Hyundai Capital among them, and says Woori Bank and NH Nonghyup Bank saw attempts by outside unauthorised parties.

It writes that, at the banks where leaks were confirmed, business-support services were used as the route of attack. For Shinhan Bank it reports abnormal access through an inquiry service for loan recruiters and others, with about 25,000 customers’ information leaked, including names, phone numbers, annual income and calculated loan limits, and some resident registration numbers and linkage information. For KB Kookmin Bank it reports 119 customers’ personal information leaked through an employee mobile work-support system. For Hana Bank it reports 89 customers’ information leaked through abnormal access to a sales-support system.

Sports Hankook says the financial authorities widened their checks to external web pages used by employees, loan recruiters and contractors, and asked firms to verify authentication, access control, information-query permissions and anomaly detection. It also writes that it has not been confirmed whether the attack targets and the security measures applied were the same at each bank.

What the Police and the Prime Minister Said

On 6 October, Yonhap reports that the National Office of Investigation formed a 28-member team to investigate on suspicion of violations of the information and communications network law. It quotes the office: “(We) will carry out an investigation swiftly and strictly while closely cooperating with relevant agencies to ease the public’s anxiety.” Seoul Shinmun says the team has four units under the head of the cyber terror response division, and that the office is reviewing whether the case should go to the new Serious Crime Investigation Agency.

The same day Yonhap quotes Prime Minister Han Seong-sook, speaking at a meeting she presided over with related ministers: “This is a serious situation because this incident is believed to have taken advantage of artificial intelligence, and if AI is used in phishing attacks, it could lead to secondary damage.” She also told the police to mobilise all available capabilities, and urged financial authorities to ensure that affected institutions provide proper customer protection measures and compensation.

The Structural Read

The President’s two Korean sentences make different points. Seoul Shinmun quotes one about circumstances in which AI was used having come to light in some cases. It quotes another, which Yonhap’s English report does not carry, about AI making it possible to hack easily without special ability.

Sports Hankook writes that, at the major banks where leaks were confirmed, business-support services were used as the route of attack, and that the financial authorities widened their checks to external web pages used by employees, loan recruiters and contractors. None of the nine documents read says how AI was used in those cases.

The statements come from different bodies on different days: Shinhan Bank on the Thursday before 4 October, the financial watchdog’s chair on 4 October, and the police, the Prime Minister and the President on 6 October. In Yonhap’s English, the wording of the AI statements ranges from “did not rule out” to “is believed to have taken advantage of” to “details have emerged of the possible use”.

Three Implications

THE WORDS ARE HEDGED AT EVERY LEVEL In Yonhap’s English, the financial watchdog’s chair did not rule out AI use, the Prime Minister said the incident is believed to have taken advantage of AI, and the President cited details of possible use. In the nine documents read, none names a tool, a model or a developer.

THE ROUTE DESCRIBED IS BUSINESS SUPPORT Sports Hankook describes entry through a loan-recruiter inquiry service, an employee mobile work-support system and a sales-support system, and says the authorities widened checks to external pages used by staff, recruiters and contractors. It writes that it is not confirmed whether the attack targets and security measures were the same at each bank.

WHAT REMAINS OPEN The official transcript of the Cabinet meeting, the banks’ own notices and the regulators’ own releases were not read, and, among the documents read, the KB Kookmin figure of 119 customers appears only in Sports Hankook. This publication draws no conclusion about whether AI was used or about who carried out the attacks.

What Is Not Established

The President’s words are given as Yonhap and the Korean newspapers quote them. This publication did not read an official transcript of the Cabinet meeting from the Presidential Office, and it did not read the banks’ own notices or the financial authorities’ own releases; their statements are read through Yonhap and Sports Hankook. Among the nine documents read, the KB Kookmin figure of 119 customers appears only in Sports Hankook.

In the nine documents read, no AI tool, model or developer is named, and none says how AI was used. This publication draws no conclusion about whether AI was used, about who carried out the attacks, or about any bank. It did not contact the Presidential Office, the police, the Financial Services Commission or any bank.

The Bottom Line

At a Cabinet meeting on 6 October, President Lee said, in Yonhap’s translation, that in some hacking cases “details have emerged of the possible use of artificial intelligence”. At a separate meeting with ministers that day, Prime Minister Han Seong-sook said the incident “is believed to have taken advantage of artificial intelligence”. The police have formed a 28-member team, and Sports Hankook reports that, at the major banks where leaks were confirmed, business-support services were used as the route of attack.

All of it is the named bodies’ statements as Yonhap and the Korean newspapers report them; this publication verified none of it independently.