South Korea is investigating a series of bank hacking incidents after President Lee Jae Myung said artificial intelligence may have been used in some of the attacks. The warning adds to growing concern about how AI could change cybercrime and increase risks for banks around the world. Lee made the comments on October 6, 2026, during a cabinet meeting, saying signs had appeared that AI models were involved in some recent attacks and ordering officials to investigate the incidents quickly.
The attacks affected commercial banks and led to concerns about customer information. South Korean authorities have started a full investigation, with several major banks reporting cyberattacks, including Shinhan Bank and KB Kookmin Bank. Reports have also pointed to breaches involving Hana Bank and Woori Bank, although officials have not yet released full details about the attacks.
Authorities have also not said which AI tools were used or exactly how much customer data may have been affected. That lack of information makes it difficult to know how advanced the attacks were or how much of a role artificial intelligence played. Investigators will need to examine the methods used by the hackers before drawing firm conclusions.
AI can help criminals in several ways. It can speed up research, create convincing messages and help attackers analyze large amounts of information, while automated systems can also search for weak points in computer networks. These tools may allow small groups to carry out attacks that once required much more time and technical skill.
Banks are attractive targets because they hold valuable financial and personal data. A successful attack can expose names, account information and other private details, while also damaging public trust in financial institutions. South Korea has a highly connected digital economy, and banks and other financial companies depend heavily on online systems, making cybersecurity a major national concern.
Lee has ordered officials to develop security methods designed for the AI era. That is important because traditional cybersecurity systems may not always be enough when attackers use tools that can change quickly. At the same time, AI can also help defenders, with banks using machine learning to find unusual behavior, detect fraud and identify possible attacks.
Defensive AI systems can examine huge amounts of data much faster than human teams. The challenge is keeping those defensive tools ahead of criminal use as the technology develops. South Korea is therefore facing a growing technology race in which financial institutions must protect their systems while ensuring that new AI tools remain useful for businesses and consumers.
The attacks also show how cybercrime is becoming an international issue. A hacker can operate in one country while attacking a bank in another, and digital systems do not follow national borders in the same way as physical crimes. That makes cooperation between governments, financial institutions and technology companies increasingly important.
South Korea will need to work with banks, technology firms and foreign security agencies to understand how the attacks happened. The country may also review its rules for reporting data breaches, while customers will want clear information if their personal data has been exposed. Banks may need to strengthen passwords, access controls and monitoring systems as investigators continue their work.
The October 6 warning is not proof that AI was responsible for every recent attack. Investigators still need to establish the facts and determine exactly how the reported breaches occurred. However, the possibility is serious because if AI is being used to improve bank attacks, criminals could become faster and more efficient.
That could increase the cost of cybercrime for banks and their customers. The South Korean investigation may therefore become an important test of how governments respond to AI powered attacks, and its results could influence cybersecurity policy in other countries. As AI becomes more powerful, banks will need to protect both their systems and their customers from a new generation of digital threats.
