In brief: South Korea is investigating attacks on financial firms. President Lee Jae Myung says there are signs of AI use, but no technical evidence is public. The response points to familiar weaknesses in exposed systems, access controls and suppliers.
Confirmed
The Financial Services Commission was notified of an incident at Shinhan Card on 30 September and convened emergency meetings on 2 and 4 October. Financial firms were ordered to examine exposed IT assets, authentication, access rights, detection and known vulnerabilities.
The FSC includes systems used by loan brokers, contractors and employees in its checks. It also called for faster indicator sharing and preparations for follow-on fraud such as phishing.
A separate notice corrects broader claims: authorities have not confirmed the loss of account data or other directly usable transaction information, nor any transfer of stolen data to China. This limits what is currently substantiated.
What remains open about AI
Lee said on 6 October that signs of artificial-intelligence use had emerged in some incidents. Public information does not identify models, telemetry, exploit chains or forensic artefacts. It therefore remains unclear whether AI accelerated reconnaissance and scanning, generated phishing material or played any operational role.
The statement does not establish an autonomous AI attack. Fast or broad activity may be AI-assisted, but conventional automation can produce similar patterns. Only technical evidence could distinguish these possibilities.
Pandorex Analysis
The regulator's concrete response concentrates on established security controls: reduce exposed assets, enforce authentication, limit privileges, include suppliers and share indicators. This does not rule out AI assistance, but it shows that the preliminary root-cause work has not confirmed a new attack class.
South Korea has also tested frontier AI for defensive security work since September. The FSC now wants to expand AI-based defence and Zero Trust architectures. That strategy may shorten response times, but it is not retrospective proof of AI on the attacker side. The defensible position is therefore narrow: the attacks are confirmed; the AI attribution is plausible but unproven.