South Korea warns of possible AI use in banking hacks

SEOUL, Oct 6 — Artificial intelligence may have been used in a string of cyberattacks targeting South Korea’s financial sector, the president said today, as police announced the launch of an investigation.

More than seven financial institutions, including some of South Korea’s biggest banks, have reported customer data breaches in the past week.

The ability of AI systems to find previously unknown software vulnerabilities and hack banks, companies or government infrastructure is in the global spotlight as leading labs release ever-more advanced models.

“There are signs that artificial intelligence was used in some hacking attacks, causing considerable concern and anxiety among the public,” President Lee Jae Myung told a cabinet meeting on Tuesday.

“We have now reached a point where AI can make (hacking) easy for even those without special skills,” he said.

More than 68,000 people have been affected by the hacks, according to the Financial Services Commission.

Shinhan Bank, one of the hacked institutions, said information attached to loan applications for about 25,000 customers, including names, phone numbers and annual income, had been leaked.

“With advances in AI technology, hacking methods are becoming increasingly sophisticated, while the scope of the damage is spreading across all areas on a scale that is difficult to compare with the past,” Lee said.

“The government, companies and our society as a whole need to recognise the seriousness of the current situation and remain particularly vigilant.”

Police said today that an investigation had been launched at Lee’s urging.

A government official told AFP it was “highly likely” that Artex AI, an open-source security testing tool believed to be a Chinese AI system, was used in the attacks.

But officials have said that its use does not indicate that the attackers were Chinese.

“Attackers can move between and use IP addresses in multiple locations, so it is impossible to identify an attacker based on an IP address alone,” Park Sang-won, head of the Financial Security Institute, told reporters.

An IP address, or internet protocol address, is a unique number assigned to a particular internet connection.

In Japan meanwhile, at least three companies have reported data leaks in recent days, while 10 firms have said their data may have been compromised following unauthorised access to servers and other websites.

The major car-sharing company Times Car said the data of 6.6 million accounts had been leaked, while a Japanese BBQ restaurant chain said that the personal data of more than 10 million app users had been leaked. — AFP