Welcome Savings Bank has confirmed that hackers broke into its corporate client management system and leaked up to 2,200 corporate-customer records, making it the seventh South Korean financial company hit in a wave of breaches authorities suspect were carried out with the help of AI agents. The bank detected the intrusion during an internal review on Saturday, October 3, and reported it to regulators.
The exposed records include company names and the names, email addresses, and phone numbers of corporate contacts. Welcome Savings said it is still investigating the exact scale of the breach and the route of intrusion, and plans to notify affected corporate contacts individually.
A seventh victim in a sector-wide wave
The discovery extends a hacking campaign that has now touched seven firms: Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank, and Hyundai Capital. Information on roughly 66,000 people has leaked in total.
Shinhan alone saw data on more than 25,700 customers — names, phone numbers, annual incomes, and loan limits, plus resident registration numbers for 66 of them — taken through a service used by loan brokers.
Yegaram Savings Bank disclosed a September 30 attack that exposed about 40,000 customers' names, dates of birth, and contact details, while Hyundai Capital reported the breach of 146 housing-loan agents' records.
Woori Bank and NH NongHyup Bank were also targeted but successfully blocked the intruders, and the National Agricultural Cooperative Federation detected access attempts from an IP address previously used in the Shinhan attack.
Regulators on emergency footing
The pattern has put the entire financial sector on high alert. Financial Services Commission Chairman Lee Eog-weon convened an emergency review meeting with financial industry representatives on Sunday, October 4, warning: "We cannot rule out the possibility that AI was used in the attacks. The entire financial sector must recognize the gravity of the situation and remain on the highest alert."
Authorities flagged weak authentication and excessive data retention and access as key weaknesses across the industry, warning of stern penalties for similar failures. The Financial Supervisory Service sent alerts about malicious IP addresses tied to the attacks to roughly 500 financial firms, which must complete emergency checks and submit their findings by Thursday.
Investigators believe the attacks were not aimed at specific institutions but instead used AI tools to probe vulnerabilities across many organizations. The main vectors appear to have been employee-facing websites and business support applications — systems with less stringent authentication than customer-facing banking apps.
A Genians security researcher previously found the name of ARTEX, an open-source AI penetration-testing tool with a Chinese-language description, on a web server used in the attacks, though the name alone does not prove the attackers actually used it.
Still an open question how far it goes
Two online lending platforms, PFCT and MOUDA, also reported external intrusions on September 27 — about 300 customers' data at PFCT — but it remains unconfirmed whether those leaks are part of the same AI-assisted campaign.
With the list of victims still growing, regulators are weighing a comprehensive overhaul of the financial sector's security systems, arguing existing defenses were built for human attackers, not for AI agents that can probe thousands of targets at once. Welcome Savings said its IT teams are still combing server logs to establish the full extent of the damage.
By Hamza Faisal
