South Korea bank hack: CrowdStrike links it to AI tools

Incident

Why it matters

Korean bank customers: the regulator says Shinhan Bank had a breach on 30 Sep, then attacks hit other big lenders. CrowdStrike says the attacker used AI tools such as ARTEX and DeepSeek, and is likely a Chinese speaker (moderate confidence).

The facts

  1. Confirmed

    South Korea's financial regulator says Shinhan Bank had a data breach on 30 Sep, followed by cyberattacks on other big lenders such as KB Kookmin.

    Financial Services Commission (Korea) press note: emergency response meeting, 2 Oct 2026 (in Korean)

  2. Unconfirmed

    CrowdStrike says the attacker used ARTEX, a Chinese AI hacking-test tool, and models like DeepSeek to steal Korean financial data. It rates the attacker as likely a Chinese speaker out for money, with moderate confidence.

    “the threat actor is likely a Chinese speaker and financially motivated”

    Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance (CrowdStrike, 7 Oct 2026)

  3. Confirmed

    ARTEX's author says attackers misused it for cyberattacks and that the author had no part in them. The tool gets no more updates and is closed to the public.

    “ARTEX 项目将不再更新，并转为闭源”

    ARTEX security statement, Autumn-27 GitHub profile, 8 Oct 2026 (in Chinese)

Behind the headline

  1. Confirmed

    CrowdStrike says the attacker left its AI chat logs open on its servers. In them, it asked Claude where criminals sell stolen Korean data.

    “asked Claude where threat actors typically sell Korean data breach information”

    Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance (CrowdStrike, 7 Oct 2026)

  2. Confirmed

    Korea's regulator now counts 16 financial firms hit around the Shinhan breach and about 100,000 records leaked. It is still checking whether one attacker and AI were behind them.

    “신한은행 사고 전후 총 16개사 침해사고 확인”

    Financial Services Commission (Korea) press note: second emergency response meeting, 14 Oct 2026 (in Korean)

How it unfolded

  1. Late Sep 2026The attack campaign begins, CrowdStrike says. Source: CrowdStrike
  2. 30 SepData breach at Shinhan Bank. Source: Korea FSC
  3. 2 OctThe regulator calls an emergency meeting with banks. Source: Korea FSC
  4. 7 OctCrowdStrike publishes its report. Source: CrowdStrike
  5. 8 OctARTEX's author closes the tool to the public. Source: GitHub
  6. 14 OctThe regulator counts 16 firms hit and about 100,000 records leaked. Source: Korea FSC

Related