AI-powered cyberattacks on South Korea, Japan raise systemic risks for financial firms

A surge of cyberattacks across South Korea and Japan, many of which investigators believe were aided by artificial intelligence, is exposing systemic vulnerabilities in the financial sector and prompting urgent government action. The breaches have compromised data on tens of thousands of customers and highlight how AI is enabling attackers with limited technical skills to carry out sophisticated campaigns.

In Japan, the government has declared a cybersecurity emergency. Major companies including convenience store chain Lawson, brokerage Daiwa Securities, second-hand retailer BookOff and car-sharing service Times Car have reported data leaks. The Times Car breach exposed information linked to approximately 6.6 million customer accounts, according to reports by Kyodo News and other outlets.

Japan recorded more cybersecurity incidents in the first nine months of this year than in all of last year, data cited by Reuters showed. Incidents reached 86 in September, up about 18 percent from August and 37 percent from July, according to data from TrendAI cited by Reuters.

“Cyberattacks are increasing in both quality and quantity, the methods are becoming more sophisticated, and they are having a tremendous impact on people's lives, and of course, causing significant disruption to business activities,” said Toshihiro Furukawa, Japan’s Digital Transformation Minister, as reported by multiple outlets.

In South Korea, nine banks and two mega-churches are investigating attacks that may have involved AI tools, according to Reuters. Government data shows the country recorded 1,236 cyber incidents in the first half of the year, up 20 percent from a year earlier. While server hacking cases fell, reports of distributed denial-of-service (DDoS) attacks and ransomware rose 56.7 percent and 76.8 percent respectively, according to government data cited by Reuters.

South Korea’s Financial Services Commission said the hacks have affected more than 68,000 people. Yegaram Savings Bank reported about 40,000 customers impacted, while Shinhan Bank said information attached to loan applications for about 25,000 customers — including names, phone numbers and annual income — was leaked, according to reports from Bloomberg and AFP.

US cybersecurity firm CrowdStrike said a suspected attacker behind the South Korean bank incidents was likely a 26-year-old based in China’s Guangdong province, according to a report by Bloomberg. CrowdStrike assessed the person used Anthropic’s Claude Code to conduct research and create a resume, along with the Chinese-developed AI tool ARTEX and models from DeepSeek and x.AI. The firm said the individual was “likely a Chinese speaker and financially motivated.”

“While (the hacker’s) capabilities were not terribly sophisticated they were effective,” said Adam Meyers, CrowdStrike’s senior vice president of counter adversary operations, as reported by Reuters.

The developer of ARTEX, known as Autumn-27, announced on code-hosting platform GitHub that the tool would be converted to closed-source after it was “abused by some bad actors” to launch cyberattacks. South Korea’s government said it was “highly likely” ARTEX had been used in the bank breaches, according to AFP.

Cybersecurity experts say AI is fundamentally changing the threat landscape. “AI doesn’t get tired… My view is that Japan is essentially being subjected to carpet bombing,” said Nobuo Miwa, president of Tokyo-based cybersecurity firm S&J Corp, as reported by Reuters. Miwa said attackers have crossed a threshold in “effort, motivation and technical capability,” while AI has largely erased language and other barriers that once hindered foreign hackers.

Choi Kyoungjin, director of the Center for AI, Data and Policy at Gachon University near Seoul, told Reuters that AI-powered tools are making it harder for defenders to spot suspicious behavior. “With general-purpose AI models, even ordinary users with malicious intent can ask the system to look for vulnerabilities and it will do much of that work for them,” he said.

Japanese authorities are investigating whether the attacks are linked. “At this stage, it is not clear what the background to these cases is or whether there are any links between them,” Japan police chief Yoshinobu Kusunoki said on Thursday, as reported by AFP.

South Korean President Lee Jae Myung said on Tuesday, according to AFP, that as AI makes hacking more sophisticated, “the scope of the damage is spreading across all areas on a scale that is difficult to compare with the past.”

Regulators are responding. South Korea’s Financial Services Commission has directed financial industry associations, regulators and affected executives to complete a 12-point cybersecurity self-assessment, Reuters reported. In Japan, Digital Transformation Minister Furukawa convened a meeting of ministries and agencies, and the National Cybersecurity Office plans to issue warnings to businesses.

The ruling Liberal Democratic Party’s national cybersecurity strategy headquarters urged the government to reinforce joint public-private response systems. Masaaki Taira, who heads AI policy for the party, said recent attacks have taken on the character of “saturation attacks” in which AI is used to automatically repeat assaults on a massive scale, as reported by Kyodo News. “We need technical countermeasures that can automatically detect anomalies and block the spread of damage after an IT system is breached but before sensitive information is actually leaked outside,” he said.

Although the breaches have not yet resulted in material financial losses, risks could increase if stolen data is used in phishing or text-message “smishing” campaigns, Karen Wu, senior analyst at Fitch, wrote in a note cited by Reuters. “We expect the incidents to result in regulatory penalties, customer compensation costs, and a sector-wide increase in cybersecurity spending,” Wu said.

Warnings about AI’s growing role in cybercrime are increasingly coming from the technology’s developers. “At this point, we can assume that all threat actors are using AI in some capacity and their operations have benefited,” John Hultquist, chief analyst at Google’s Threat Intelligence Group, said last month, as reported by Reuters.

S&J’s Miwa said he expected elevated levels of cyberattacks to persist. “The attackers have experienced a breakthrough that has rendered many of the old assumptions obsolete,” he told Reuters.