SEOUL: Advanced artificial intelligence tools may have been used in a cyberattack on South Korea’s Shinhan Bank Co. that exposed information on about 25,000 customers, Yonhap News reported, highlighting the risk of automated hacking against financial institutions.
Attackers probably used sophisticated AI agents to probe for vulnerabilities and gain unauthorised access to a service used by loan recruiters, Yonhap said, citing cybersecurity experts.
Shinhan Bank, a unit of Shinhan Financial Group Co., said Thursday (Oct 1) that an unauthorised external party accessed certain services and obtained customer information. The lender is investigating the cause, scope and potential impact with authorities and outside cybersecurity experts.
"At this time, Shinhan Bank is not in a position to reasonably quantify the specific impact of the incident, if any, on its financial condition, results of operations or business activities,” it said. Information exposed in the breach included customer names, phone numbers, annual income and borrowing limits, the bank said.
The incident highlights an emerging cybersecurity risk as AI allows hackers to automate the search for security gaps across large numbers of systems.
South Korea’s Financial Supervisory Service began an emergency on-site inspection to ascertain the nature and extent of the Shinhan breach, a spokesperson for the regulator said.
It comes as a wave of hacks hits other Korean lenders. KB Kookmin Bank said Friday that personal information of 119 customers had been leaked due to an external intrusion. Hana Bank also said 89 customers were affected by a hack.
The Financial Services Commission held a meeting with local banks Friday to discuss the data breaches and is set to hold another meeting next week.
Mun Chong-hyun, director at Genians, a cybersecurity firm, said several recent attacks in South Korea have featured such AI tools that have been developed and shared for defensive purposes. They can however be a "double-edged sword” when used in hacking attempts to facilitate crime.
"As AI-related technologies advance, source codes are being shared indiscriminately and used for malicious AI hacking attempts, so many people need to take caution,” added Mun.
The number affected by the Shinhan breach is relatively small compared with some of South Korea’s biggest data breaches.
"This particular breach is worrying because it exposed both personal and financial information,” said Sungho Hwang, Korea country manager at NordVPN. That information can be used to craft personalised scams, which generative AI has made more convincing, he added.
South Korea has suffered far larger breaches, including one at Lotte Card Co. that exposed information belonging to nearly three million customers. A hack at Coupang Inc.’s South Korean unit hit more than 33 million accounts and the country’s privacy regulator imposed a record penalty on the e-commerce giant over the breach and other privacy violations. - Bloomberg
