Artificial intelligence is making it easier for hackers to search for weaknesses in financial networks. But a series of cyberattacks in South Korea has exposed a more fundamental problem. Many financial institutions are struggling to maintain basic security protections, leaving customer information vulnerable as cyber threats become more sophisticated.
South Korea’s Financial Services Commission, the country’s financial regulator, said Wednesday that 16 financial companies had suffered security breaches, exposing approximately 100,000 personal records. A subsequent review of 555 financial institutions found cybersecurity deficiencies at 130 companies, or 23.4%, including some of the country’s largest banks.
The findings highlight a challenge extending beyond South Korea. Banks and financial technology companies face a growing threat from AI tools that can accelerate the search for security vulnerabilities, even as some institutions struggle to maintain existing defenses. The Korean government’s response also signals how such attacks can lead to tighter oversight, additional security requirements and greater accountability for corporate executives.
The suspected use of AI is central to the investigation.
Cybersecurity researchers have linked some of the attacks to AI software designed to automate penetration testing, a process normally used to identify weaknesses in computer systems. Such tools can accelerate the search for vulnerabilities that might otherwise require extensive manual testing. South Korean authorities are still investigating how AI was used, whether the incidents are connected and who was responsible.
The security review, however, has already uncovered weaknesses across the financial industry.
Many companies had failed to install the latest security patches or properly maintain systems that no longer received support from their manufacturers. Others lacked continuous monitoring or adequate controls over access to their networks.
These deficiencies are particularly concerning because they involve established cybersecurity practices rather than entirely new threats. AI may give attackers more efficient ways to discover weaknesses, but preventing unauthorized access still depends on financial institutions keeping software updated, monitoring suspicious activity and restricting access to sensitive information.
The investigation has not established whether the deficiencies identified in the industry review were directly responsible for the breaches.
Some of the most significant findings involved South Korea’s largest commercial lenders.
Documents obtained by Park Sung-hoon, a South Korean lawmaker serving on parliament’s financial oversight committee, showed that Shinhan Bank, KB Kookmin Bank and Hana Bank had identified weaknesses in controls designed to prevent users from accessing or modifying other customers’ information.
Shinhan Bank reported deficiencies in one security category, while KB Kookmin Bank and Hana Bank initially identified problems in two categories each.
Despite those findings, KB Kookmin Bank and Hana Bank ultimately submitted final assessments rating every security category as satisfactory.
The attacks were not confined to commercial banks. Additional affected companies included DB Savings Bank, South Korean financial services provider KDB Capital and Streami, which operates the Gopax cryptocurrency exchange.
The breaches exposed names, contact details and South Korean national identification numbers. Regulators said they had found no evidence that account passwords or credit card numbers had been compromised, reducing immediate concerns about unauthorized financial transactions.
The discovery of widespread security shortcomings has prompted the government to move beyond investigating individual attacks.
South Korean regulators plan to conduct a comprehensive examination of financial institutions’ cybersecurity systems, focusing on external network connections, authentication procedures and access controls.
Financial companies will be required to identify and maintain updated records of connections between their internal systems and external networks. Authorities also intend to strengthen oversight of how institutions manage access permissions and monitor potential threats.
The government is preparing additional measures to improve cooperation among financial institutions.
Under the proposed changes, companies would be able to share information about cyber threats identified within their own systems through a centralized monitoring network. The initiative is intended to help financial institutions recognize emerging attacks and respond more quickly.
South Korea’s Financial Security Institute, an organization responsible for supporting cybersecurity across the financial industry, is also considering developing a shared AI security monitoring system for smaller financial companies.
The proposal reflects the government’s effort to use AI to strengthen defenses against increasingly automated cyber threats.
Regulators are also seeking stronger accountability from financial executives.
Shin Jin-chang, secretary general of the Financial Services Commission, criticized financial institutions for failing to implement fundamental security measures despite repeated instructions to strengthen their defenses.
During Wednesday’s emergency meeting, Shin called for a comprehensive reassessment of cybersecurity management and stronger accountability for chief executives and corporate boards.
The measures could have implications for financial institutions’ operating costs and the cybersecurity industry as companies strengthen monitoring systems, update aging infrastructure and respond to tighter regulatory requirements.
The investigation into the breaches remains ongoing, and the full extent of AI’s involvement has yet to be established.
What the security review has revealed is already significant. As AI tools make it easier to identify potential weaknesses in financial networks, South Korea’s banking industry is being forced to confront security problems that existed long before AI became a tool for cyberattacks.
