South Korea's FSC orders a financial-sector security review after suspected AI-driven attacks on six banks

South Korea's FSC orders a financial-sector security review after suspected AI-driven attacks on six banks

2 October 2026: South Korea's Financial Services Commission (FSC) held an emergency meeting on Friday 2 October 2026 and ordered financial firms to review their externally reachable systems, after attacks suspected to have been carried out with AI agents exposed customer data at several banks, according to reports by Korea JoongAng Daily and Seoul Economic Daily.

Not yet independently verified. The FSC's own releases of 14 October and 5 November confirm the review, give sector-wide figures and now describe AI-driven hacking, but they do not give per-bank figures, which rest on press reports. We will update this when it can be confirmed, and remove this note.

Update, 6 November 2026: the FSC has published new totals. Between 30 September and 3 November, 37 financial companies reported 40 hacking incidents: 4 banks, 5 financial investment businesses, 3 insurers, 5 savings banks, 1 mutual finance business, 2 specialised credit finance companies, 4 P2P lenders, 10 electronic financial service providers and 3 virtual asset providers. It counts about 473,000 cases of personal information, mostly employee data, customer names, resident registration numbers and account numbers. It reports no theft of account passwords, about KRW 1 billion lost, mostly from management accounts at smaller firms, and no loss to individual users. These replace the 14 October figures of 16 firms and about 100,000 items given below. The FSC describes the threats as driven by artificial intelligence, without saying these incidents were confirmed as AI-agent attacks.

What happened

The reports name KB Kookmin, Shinhan, Hana, Woori, NH Nonghyup and BNK as targets. At Shinhan, about 25,000 customers' data was exposed through a lookup page for loan brokers that required only a code sent by text message, with no certificate. KB Kookmin reported 119 customers affected through an employee mobile support system, Hana 89 through a sales-support system, and BNK 11 cases. The pattern described is automated probing of less-protected side doors: partner portals and staff tools rather than core banking systems.

What the regulator ordered

According to the reports, the FSC told financial firms to take an inventory of all externally reachable IT assets, including AI systems, and run security checks on them; to find any routes to internal data that bypass authentication; and to share attacking IP addresses and intrusion logs with KISA and other agencies and report findings promptly. The FSC said it would develop further regulatory measures, and the Financial Supervisory Service sent an inspection team to Shinhan.

Update, 2 November 2026: at a follow-up meeting on 14 October, the FSC said 16 financial companies had been confirmed breached, with about 100,000 pieces of customer data exposed (names, contact details, resident registration numbers and email addresses) and no account passwords or card numbers. All 555 firms completed its 12-point self-evaluation checklist: 425 rated their measures appropriate and 130 found gaps, mostly in security patching and control systems, more often among electronic financial service and peer-to-peer lending firms. The Financial Supervisory Service and the Financial Security Institute are still checking whether the incidents are linked, came from one attacker, and whether AI was used. The FSC plans an exhaustive inspection of firms' cybersecurity management.

Who is affected

Korean banks, card companies, insurers and fintechs, and the software vendors that build or host their broker portals, partner extranets and staff mobile tools. Foreign vendors serving Korean financial firms should expect questionnaires that follow the FSC's checklist.

What to do

1. List every internet-facing application that can reach customer data, including portals for brokers, agents and partners.
2. Remove single-factor access, such as text-message codes alone, from any page that returns customer records.
3. Add rate limiting and anomaly detection for automated lookups; AI-driven probing tends to look like many small, valid-seeming queries.
4. Vendors: prepare evidence of authentication strength and logging for the portals you run for Korean financial clients.
5. Watch for the FSC's follow-up measures.

Why it matters for buyers

If the attribution holds, this is one of the first cases where a financial regulator has responded to attacks it believes were run by AI agents. The weakness exploited was ordinary, a lookup page with weak authentication, but automation makes such pages far cheaper to find and drain. Every regulated buyer should expect similar reviews.

Related on TrustList:

• Gwanak Lab raises 300 million won from Seoul Techno Holdings for financial decision AI
• Kenya's central bank consults on revised prudential and risk management guidelines, including outsourcing and cyber risk; comments by 7 November 2026

Sources

• Korea JoongAng Daily: AI hackers target Korea's banks, trigger industrywide security review - 4 October 2026
• Seoul Economic Daily: Signs of AI-driven hacking emerge in Korean bank data - 2 October 2026
• Financial Services Commission: Authorities Hold Meeting on Cybersecurity Management in Financial Sector to Bolster Anti-Hacking Measures - 14 October 2026
• Financial Services Commission: FSC holds meeting on strengthening cyber defense framework amid growing AI hacking threats - 5 November 2026
• FSC: FSC Holds Meeting on Strengthening Cyber Defense Framework amid Growing AI Hacking Threats (press release list) - 5 November 2026