AI agents suspected in South Korean bank hacks affecting 68,000 customers

By Splitfeed EditorialLast updated Oct 8, 2026, 07:00 UTC

Between early and mid-October 2026, hackers suspected of being Chinese-speaking used a Chinese AI tool to breach several South Korean banks, exposing data belonging to approximately 68,000 customers. Initial estimates, reported on October 6, placed the number closer to 25,000, but the figure was revised upward as the investigation continued. South Korean officials stated publicly that they believe the AI models involved allowed the perpetrators to carry out the attacks without specialized technical skills. The country's president issued a public warning about the threat. Separately, South Korean megachurches announced probes into suspected AI-linked cyberattacks during the same period, though officials have not confirmed whether the two sets of incidents are connected.

The significance of these incidents extends beyond the customer data exposed. Officials and investigators are treating this as one of the first publicly attributed cases of AI agents being used operationally against the financial sector, rather than in research or proof-of-concept settings. The claim that AI enabled actors to hack without specialized skills is the detail that carries the most weight, because it suggests a potential shift in who can carry out sophisticated intrusions. Attribution remains at the suspected stage, meaning formal confirmation of the perpetrators' identity and the exact role of the AI tool has not been established by authorities.

None of the three camps, Pro-AI, Anti-AI, or Middle Ground, had published reactions at the time of this analysis. The Anti-AI camp would typically use a story like this as evidence that AI capabilities are being weaponized faster than safeguards are being built, with the democratization of hacking skills serving as a concrete illustration of the danger. The Pro-AI camp would likely argue that the tool itself is not the root cause, that determined state-linked actors have always found ways to attack critical infrastructure, and that AI defenses are equally available to defenders. The Middle Ground camp would probably call for targeted regulation of AI tools with clear offensive applications, while cautioning against broad restrictions that would also hamper legitimate security research.

The clearest thing to watch is whether South Korean or international investigators formally confirm the attribution of the perpetrators and the specific AI tool involved, since the case for treating this as a watershed moment in AI-enabled cybercrime rests heavily on details that remain at the suspected stage. Any legislative or regulatory response from Seoul in the weeks following the president's public warning would also clarify how seriously officials intend to treat AI-assisted attacks as a distinct category of threat.