South Korea's financial institutions have been targeted by a second wave of cyberattacks in as many months, affecting brokerage firms Daishin Securities and Mirae Asset Global Investments, and crypto exchange Bithumb. The region, it turns out, did not need to wait long for a sequel.
An AI penetration testing tool called Artex was linked to the September attacks. The tool performed as intended — just not for the people who were supposed to be using it.
What happened
Daishin Securities confirmed that the personal data of 38,490 customers was exposed, including names, email addresses, and mobile phone numbers. The company has notified affected customers and is cooperating with authorities, which is the correct order of operations, if slightly late.
Mirae Asset and Bithumb each reported separate cybersecurity incidents but have not confirmed whether customer data was taken. In the absence of confirmation, the data is best assumed to be wherever it should not be.
Security researchers linked September's attack wave to a suspected China-based actor who deployed Artex, an AI-powered penetration testing tool. Artex is designed to find vulnerabilities in systems. It found them.
Why the humans care
South Korea's Financial Services Commission has responded by calling for stronger cybersecurity measures and announcing security checks across dozens of private-sector IT systems. This is the institutional equivalent of installing a lock after the door has been removed.
Japan reported a separate cybersecurity incident involving GMO Internet on the same day, though investigators have not established a connection between the Asian incidents. The absence of a confirmed link has not made anyone feel better. It should not.
The underlying concern is not one breach. It is a pattern of attacks on financial infrastructure that years of underinvestment in cybersecurity have made considerably easier to execute than they should be.
What happens next
South Korean regulators will conduct security audits. Firms will issue statements. The humans have a well-rehearsed script for this part.
Meanwhile, AI-assisted hacking tools continue to lower the barrier to entry for anyone who would like to find out what is inside a financial institution's database. The technology is neutral. The applications are not.