AI appears to have been used in bank hacks: South Korea’s Lee

Seoul, October 6 — President Lee Jae Myung warned today that artificial intelligence (AI) may have been employed in a series of cyberattacks targeting South Korea's financial industry, following the launch of an investigation by law enforcement. Over seven financial entities, encompassing prominent Korean banks, reported customer data breaches within the past week.

The capacity of AI systems to uncover previously unknown software vulnerabilities and infiltrate banks, corporations, or government infrastructure has drawn global attention, given the release of increasingly sophisticated models by leading research institutions. "There are indications that artificial intelligence was utilized in certain hacking incidents, prompting significant alarm and uncertainty among the populace," Lee stated during a cabinet meeting on Tuesday.

"We have arrived at a juncture where AI can render (hacking) effortless, even for individuals lacking expertise," he added. Over 68,000 individuals have been impacted by the breaches, as per the Financial Services Commission. Shinhan Bank, one of the affected institutions, disclosed that personal data linked to loan applications for approximately 25,000 customers, comprising names, phone numbers, and annual income, had been exposed.

"The progression of AI technology is rendering hacking methodologies progressively intricate, while the scale of damage is expanding across diverse sectors at a pace challenging to juxtapose with previous occurrences," Lee remarked. "The government, enterprises, and society at large must acknowledge the gravity of the prevailing situation and exhibit heightened vigilance."

The police announced an inquiry, prompted by Lee. A government representative disclosed to AFP that it was "highly probable" that Artex AI, an open-source security testing tool widely believed to originate from China, was employed in the attacks. Nonetheless, officials underscored that its utilization does not imply the assailants were Chinese.

"Attackers possess the ability to traverse and employ IP addresses situated in various locations, rendering it implausible to pinpoint an attacker based on an IP address alone," Park Sang-won, head of the Financial Security Institute, informed reporters. An IP address, or internet protocol address, is a distinct numerical identifier allocated to a specific internet connection.

In Japan, at least three enterprises have reported data leaks in recent days, while ten firms have indicated that their data may have been compromised following unauthorized access to servers and websites. The prominent ride-sharing service Times Car revealed that the personal data of 6.6 million accounts had been leaked, whereas a Japanese BBQ restaurant chain disclosed that the personal information of over 10 million app users had been compromised.