Shinhan Bank data breach exposes 25,000 customers in suspected AI hack

South Korea’s Shinhan Bank has suffered a data breach that exposed the personal and financial information of roughly 25,000 customers, with investigators examining whether the attackers deployed autonomous artificial intelligence agents to pull off the raid.

The incident took place on its "M Shinhan" mobile site, inside a dedicated web portal built for loan solicitation agents to track submitted customer applications. An external intruder found a way around the service's identity-verification checks, according to the bank. Once past the front door, the attacker cycled through customer identification numbers and database queries at high speed, pulling up names, phone numbers, annual incomes and approved borrowing limits.

The compromised data also includes 66 resident registration numbers — the sensitive national identity codes used across South Korea — and 97 connected information records relied on for digital identity verification.

Shinhan Bank President Jung Sang-hyuk published an apology on the bank's website, confirming that an unauthorised outside party had pulled customer records through abnormal access. Shinhan said it cut off connections from the offending external IP addresses, suspended the loan agent portal and applied tighter security filters once it caught the activity. The bank emphasised that its mainstream retail mobile banking service, Shinhan Super SOL, was not breached.

Traces of Chinese AI testing software

Investigators and cybersecurity specialists are now focused on how automated the intrusion actually was. In Seoul, the Korea Financial Security Institute, the Financial Services Commission and the Financial Supervisory Service have all opened on-site inquiries into the bank's architecture.

Security researchers point to signs that generative AI agents may have scanned the bank's systems, spotted the application programming interface (API) weakness and run the attack scripts automatically. Moon Jong-hyun, head of the Genians Security Center, said server infrastructure linked to recent API attacks and credential stuffing in South Korea carried an HTML page title reading "ARTEX — 自主渗透测试控制台", or autonomous penetration testing console.

ARTEX AI is an open-source, large language model penetration system published mainly in Chinese. It relies on multi-agent software to automate tasks that human hackers usually piece together by hand: gathering intelligence on targets, probing for architectural flaws, planning exploit routes and running payloads. The project won an offensive and defensive security challenge run by China's Baidu Security Response Center earlier this year.

While ARTEX was built as an automated security testing package, Moon said analysts suspect that such frameworks are being repurposed by attackers to make high-volume intrusion campaigns faster and cheaper. Analysts believe the hackers are operating from abroad and that Shinhan Bank may not have been singled out in advance, but rather caught in an indiscriminate sweep that found an open door on an obscure portal.

Regulators step in

The Financial Supervisory Service said its inquiry into the lender's logging systems, intrusion detection and internal controls could take months. Investigators are examining whether Shinhan failed to deploy basic rate-limiting rules that would have flagged thousands of rapid requests coming from unusual locations.

For banking customers, the leak of borrowing amounts alongside phone numbers and personal identifiers leaves thousands exposed to highly tailored voice phishing and loan fraud scams, which have become a persistent problem in South Korea.