Hacking attempts targeting state-owned banks are on the rise, following a similar trend seen in commercial banks. As attacks utilizing artificial intelligence (AI) become more sophisticated, calls for a review of security measures and investment in defenses are growing.
On October 11, Rep. Kang Min-guk of the ruling People Power Party revealed data from the Bank of Korea, Korea Export-Import Bank, Korea Development Bank, and IBK, indicating that from 2020 to September 2026, there were a total of 4,986,964 hacking attempts against these four banks.
The number of hacking attempts has increased annually, from 358,800 in 2020 to 564,430 in 2021, 585,563 in 2022, and 738,312 in 2023. Projections for 2024 and 2025 show further increases to 780,524 and 934,858 attempts, respectively. This year alone has already seen 1,024,478 attempts by September, surpassing last year's total.
IBK accounted for over 91.9% of these attempts, with approximately 4,584,000 incidents. The Korea Development Bank recorded 399,379 attempts, the Bank of Korea had 3,076, and the Korea Export-Import Bank had 510.
While there have been no reported breaches resulting from these hacking attempts, the increasing frequency of attacks raises concerns. State-owned banks now offer internet and mobile services to individual and corporate clients, making them vulnerable to cyber threats.
Recent incidents of data breaches at various financial institutions, including state-owned banks, have heightened security concerns across the sector. From late last month to early this month, seven financial institutions, including Shinhan, KB Kookmin, Hana, and BNK Busan Bank, confirmed data leaks due to hacking.
Shinhan Bank reported that information from over 25,000 loan applicants was compromised, while about 40,000 records were leaked from Yeogaram Savings Bank. Attempts to access data from three internet-only banks, including Kakao Bank, were made using the same Internet Protocol (IP) address, but these did not result in data breaches.
The use of AI tools in hacking raises concerns that similar incidents could recur. The domestic security firm Genians Security Center indicated that the recent cyberattacks on financial institutions involved the use of the Chinese-based open-source penetration testing tool 'ARTEX.' This tool allows less experienced attackers to target multiple institutions in a short time.
In response, financial institutions are urged to reassess their security measures, including their response systems to different types of attacks, investment in information protection, and the effectiveness of simulation training. The Financial Security Agency had warned financial institutions about security risks related to externally exposed assets about two weeks before the recent data breaches occurred, raising questions about the adequacy of their responses.
According to data submitted by Rep. Han Chang-min of the Democratic Party, the Financial Security Agency held a seminar on AI security threats for financial security personnel on September 17, where they discussed examples of AI agent attacks. The agency emphasized the need for continuous management of attack surfaces for externally exposed assets, stating, 'Annual assessments are insufficient. Continuous measurement and verification are necessary.'
A financial sector official commented, 'While hacking techniques are becoming more sophisticated, we must first reassess the fundamentals of our systems that are exposed to the outside world.'
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.