Suspect in serial hacks on Korean financial firms believed to be 26-year-old in Guangdong, China; AI usage records offer identity clues (report)

What happened

According to Bloter, the attacker behind a series of hacks on Korean financial institutions is believed to be a 26-year-old living in Guangdong Province, China. The attacker used AI to probe financial institutions for security vulnerabilities and, in doing so, was analyzed to have left information in AI usage records that could be used to trace their identity. There were also indications that an AI penetration tool developed in China was used. However, the attacker's nationality and identity have not been confirmed, and it cannot be concluded that all the attacks were carried out by the same person. Police are tracing the attack routes, which passed through overseas servers.

Why it matters

The case shows that AI tools can make attacks more efficient while also leaving traces that help track attackers. It offers a reference point for how the financial sector responds to AI-driven attacks and how investigations are conducted.

Sources

• Press 금융 해킹범, 중국 국적 26세 추정…단서는 AI에 남긴 흔적 Bloter

Story thread

1. 2026-10-07 'AI hacking' hits Korean financial firms: Yegaram and Welcome Savings Bank customer data leaked; no further damage confirmed at other members (report)
2. 2026-10-08 Suspect in serial hacks on Korean financial firms believed to be 26-year-old in Guangdong, China; AI usage records offer identity clues (report)

More about Welcome Savings Bank

• 2026-10-07 P2 Other Unconfirmed KoreaSafety & alignment Welcome Savings BankYegaram Savings BankKorea Federation of Savings Banks
  'AI hacking' hits Korean financial firms: Yegaram and Welcome Savings Bank customer data leaked; no further damage confirmed at other members (report)

  According to Bloter, AI hacking targeting major Korean financial firms led to the leak of individual and corporate customer data from...