Attackers probably used sophisticated AI agents to probe for vulnerabilities and gain unauthorised access to a service used by loan recruiters, Yonhap said, citing cybersecurity experts.

Shinhan Bank, a unit of Shinhan Financial Group Co, said Thursday that an unauthorised external party accessed certain services and obtained customer information. The lender is investigating the cause, scope and potential impact with authorities and outside cybersecurity experts.

“At this time, Shinhan Bank is not in a position to reasonably quantify the specific impact of the incident, if any, on its financial condition, results of operations or business activities,” it said. Information exposed in the breach included customer names, phone numbers, annual income and borrowing limits, the bank said.

The incident highlights an emerging cybersecurity risk as AI allows hackers to automate the search for security gaps across large numbers of systems. 

South Korea’s Financial Supervisory Service began an emergency on-site inspection to ascertain the nature and extent of the Shinhan breach, a spokesperson for the regulator said. It comes as another Korean lender faced scrutiny over data security. KB Kookmin Bank said Friday that personal information of 119 customers had been leaked due to an external intrusion.

The Financial Services Commission is set to hold a meeting with local banks Friday to discuss the data breaches. 

Mun Chong-hyun, director at Genians, a cybersecurity firm, said several recent attacks in South Korea have featured such AI tools that have been developed and shared for defensive purposes. They can however be a “double-edged sword” when used in hacking attempts to facilitate crime.

“As AI-related technologies advance, source codes are being shared indiscriminately and used for malicious AI hacking attempts, so many people need to take caution,” added Mun.

The number affected by the Shinhan breach is relatively small compared with some of South Korea’s biggest data breaches.

“This particular breach is worrying because it exposed both personal and financial information,” said Sungho Hwang, Korea country manager at NordVPN. “Generative AI has made these attacks even more convincing,” he added.  

South Korea has suffered far larger breaches, including one at Lotte Card Co that exposed information belonging to nearly three million customers. A hack at Coupang Inc’s South Korean unit hit more than 33 million accounts and the country’s privacy regulator imposed a record penalty on the e-commerce giant over the breach and other privacy violations.

Uploaded by Liza Shireen Koshy