Sixteen South Korean financial firms were reportedly entered by suspected AI agents through internal support systems

In early October 2026, South Korean financial firms began reporting abnormal access to their internal support systems. By 14 October, the Financial Services Commission (FSC) told an emergency response meeting that the count had grown from the seven firms first reported to 16, spanning banks, savings banks, credit finance companies, electronic payment providers and cryptocurrency businesses. Named victims include Shinhan Bank, KB Kookmin Bank, Hana Bank, Hyundai Capital and the Korean Federation of Community Credit Cooperatives. The exposed data reportedly includes names, contact details and resident registration numbers for roughly 100,000 people.

According to the regulators, the intrusions did not go through the core banking networks. They involved abnormal access to internal support systems, and the working suspicion is that AI agents automated the process, scanning, entering and extracting data at a pace no human operator could match. No specific AI tool has been named by Korean officials, and the FSC is still investigating whether a single group is responsible. Attribution remains unconfirmed, and the AI role is a suspicion rather than a finding.

The scale per institution varies widely. Shinhan Bank reportedly saw a breach affecting about 25,000 people, KB Kookmin Bank about 119 customers and Hana Bank about 89 customers. Regulators have found no evidence so far that account or card numbers were taken. On 19 October, the chief executives of five major banks were called before a National Assembly audit, the first time all five had been summoned together since October 2022. Shinhan and KB Kookmin apologised, and Hana pledged to compensate customers for any losses. The head of Woori Bank said it faces about 200 hacking attempts a day.

The defences that failed here were not exotic. The FSC inspected 555 financial firms across 12 areas through 8 October and found security deficiencies at 130 of them, or 23.4 per cent. The common problems were missing patches, unsupported systems with little oversight, no round-the-clock monitoring, and gaps in authentication and authorisation for external systems. The FSC's own Secretary General said firms were still failing to meet basic security requirements despite repeated warnings after earlier incidents. Patching and monitoring matter, but each of them assumes the access path is known in advance. An agent that finds an unwatched support system and a valid way in is simply another authorised session until the data has gone.

GoFirm closes that gap at the execution boundary. A bulk read of resident registration numbers from a support system is an execution event. Before that export can run, a confirmation request goes to the named data owner on their registered device, and it requires their biometric approval. The same applies to any change of access scope on an internal support tool, and to any new session pulling customer records in volume. The request travels on a separate channel from the system being used, so nothing the agent controls can see it or answer it. If no confirmation arrives, the action is blocked, whether the requester is an attacker, a compromised service account or a swarm of automated agents running at machine speed.

An AI agent, however fast and however persistent, cannot produce a biometric confirmation on a named authority's registered device. The execution boundary holds regardless of how many systems the agent has already entered or how legitimate its session appears.

GoFirm is The Authority Platform. Stop unauthorised action. Every time.

In association with Osinto.ai, the collective intelligence and governance network for Security, Resilience & Defence teams.

References

1. The Korea Times. 2026. AI-driven cyberattacks hit 16 financial firms, expose 100,000 records. The Korea Times, 14 October 2026. https://www.google.com/url?q=https://www.koreatimes.co.kr/business/banking-finance/20261014/ai-driven-cyberattacks-hit-16-financial-firms-expose-100000-records&source=gmail&ust=1792661451162000&sa=E
2. The Korea Times. 2026. CEOs of major banks grilled at Assembly audit over AI cyberattacks. The Korea Times, 19 October 2026. https://www.google.com/url?q=https://www.koreatimes.co.kr/economy/20261019/ceos-of-major-banks-grilled-at-assembly-audit-over-ai-cyberattacks&source=gmail&ust=1792661451162000&sa=E
3. MoneyToday. 2026. Hacking incidents erupt across 16 financial institutions, with 100,000 records of information leaked. MoneyToday, 14 October 2026. https://www.google.com/url?q=https://www.mt.co.kr/en/finance/2026/10/14/2026101415210579063&source=gmail&ust=1792661451162000&sa=E