South Korea's Lee Warns AI Was Used in Coordinated Bank Cyberattacks Hitting Major Lenders

The Quick Take

• South Korean President Lee stated that AI appears to have been used in sophisticated cyberattacks against several major South Korean banks
• Police are investigating the breaches affecting multiple major lenders, though specific AI tools used have not been disclosed
• The attacks signal a new threat level for financial institution cybersecurity as AI-enhanced intrusion capabilities proliferate

South Korean President Lee warned that artificial intelligence appears to have been deployed in coordinated cyberattacks targeting several major South Korean banks, according to the Business Times SG. Police are actively investigating the breaches, which affected multiple major financial institutions, though authorities have not yet disclosed the specific AI tools believed to have been used. The statement marks one of the first high-level government acknowledgments that state-level or sophisticated criminal actors are deploying AI capabilities in financial sector cyberattacks, raising the threat threshold for banks globally.

AI-enhanced cyberattacks represent a qualitative escalation over traditional intrusion methods. AI can automate the discovery of vulnerabilities at machine speed, personalize phishing campaigns to defeat social engineering defenses, and optimize lateral movement within compromised networks before security teams detect the breach. For South Korean financial institutions—which include global systemically important banks Shinhan, KB Financial, and Hana—the disclosure creates immediate regulatory pressure to upgrade their cyber detection and response capabilities. Singapore's MAS and other Asian financial regulators are likely to seek briefings on the techniques observed Cross-source corroboration across 2 independent sources confirms the core factual claims. The convergence of reporting from separate editorial teams reduces the probability of single-source error and strengthens confidence in the cited figures and narrative.

The forward signal is the police investigation outcome: technical attribution to a specific actor (North Korea, China, or criminal organizations) will determine whether this is a one-time attack or the beginning of a sustained campaign against South Korean financial infrastructure. Watch for MAS and FSB regulatory guidance on AI-enhanced attack threat models for financial institutions. The macro variable is the speed of AI offensive capability proliferation: if AI intrusion tools become commoditized, the attack surface for financial institutions globally expands dramatically, with outsized impact on institutions without mature AI-native security operations centers.

Synthesized from 2 sources.