Signs of AI in Bank Hacks: Korea's FSC Widens Its Probe

At a Cabinet meeting on October 6, President Lee Jae-myung said there were indications that AI had been used in some of the recent hacking incidents. The remark came as he addressed a string of personal data breaches at financial institutions and public agencies. The president instructed the government and companies to review their security systems, establish how the incidents occurred, and keep the damage to a minimum.

What the FSC is investigating

The Financial Services Commission received Shinhan Bank’s breach report on September 30 and launched an on-site investigation. It has since folded reports filed by other financial companies into the same inquiry. The circumstances of each incident and the scope of the damage will be determined through that investigation.

A sector-wide review followed. On October 2, the FSC shared the attack information it had confirmed with financial companies and asked them to conduct security checks. On October 4, it convened an emergency meeting for the financial sector. The breach report, the on-site investigation, the sharing of attack information, and the emergency meeting all took place before the president’s remarks at the Cabinet meeting.

The key question the investigation must answer is at which stage of the attacks AI was used, and what role it actually played.

Was my data exposed?

For users, the immediate concern is the leak of personal data and the financial fraud that can follow. The FSC has confirmed that personal data was leaked at some financial companies and has issued a warning about secondary financial fraud.

At the time of its announcement, the FSC said that passwords and one-time password (OTP) information had not been leaked. For users, the most pressing questions are whether their own data was among the records exposed and exactly which fields were taken. Those details are expected to become clearer as the investigation proceeds.

Security threats that abuse AI were already on the regulator’s agenda before these incidents. The FSC took up the issue in June 2026 at a meeting with financial holding companies and outside experts. What was then a topic of discussion has now shifted into an actual breach investigation.

Three things are worth watching from here: the role of AI that the investigation uncovers, the scope of the personal data leak, and the follow-up measures taken to prevent secondary harm to users.