South Korea Investigates After Cyber Attacks.. AI Under Suspicion

The South Korean presidential office said on Sunday that President Lee Jae-myung has ordered a comprehensive investigation and actions to address the recent incidents of personal data leaks that occurred in banks, financial companies, and public institutions.

The Financial Services Commission stated in a statement that its chairman, Lee Ok-won, held an emergency meeting on Sunday with associations representing the financial sector, regulatory bodies, and executives from the affected institutions, warning that the sector must deal with the situation with the highest level of vigilance.

The chairman of the Financial Services Commission said that authorities cannot rule out the possibility of artificial intelligence being used in the attacks, and he called for an approach of "countering AI attacks using AI," also referring to broader updates to the cybersecurity framework in the financial sector.

Sunday's meeting followed similar talks held on Friday, when the Financial Services Commission reported that Shinhan Bank, KB Kookmin Bank, and others had reported being targeted by cyberattacks. Yonhap News Agency reported that Hana Bank and Woori Bank were also subjected to breaches.

No comments could be obtained from the banks outside of official working hours on Sunday.

The financial regulatory authority stated that the authorities began field investigations after Shinhan Bank reported a breach on September 30, and have since expanded the scope of investigations to include other reported incidents.

OpenAI and Anthropic, along with researchers in AI security, are investigating tens of thousands of "problematic incidents" involving the companies' advanced models.

The authority directed financial institutions to conduct comprehensive security checks, tighten access controls to information and data, reduce access to external systems, and enhance consumer protection measures.

It added that attack methods, Internet Protocol addresses, and other threat information will be quickly disseminated across the sector to prevent further cyber intrusions.

Yonhap reported that regulators believe the attacks may have targeted a large number of financial companies in search of security vulnerabilities, rather than targeting a specific institution.

The agency added, citing banking data provided to lawmakers, that the wave of cyberattacks originated from Internet Protocol addresses in several countries including the United States, Japan, Singapore, Vietnam, and Britain.

Several Korean media outlets reported that the emergency meeting on Sunday was moved up from October 7, following the discovery of additional breaches at second-tier financial institutions.

The main opposition party, the People Power Party, stated that authorities should also investigate the possibility of a connection to North Korea regarding the attacks, pointing to previous cyberattacks attributed to Pyongyang that targeted financial institutions in the country.