AI-assisted breaches at seven lenders stall South Korea's plan to loosen bank network rules

KB Kookmin took close to 68 hours to spot its breach, Hana nearly 42 and Shinhan more than 15 ^[16]. At the slow end that is nearly three days ^[23]. The two slower banks checked their logs after the FSC circulated the attacker's IP addresses from the Shinhan case ^[15]. Regulators had built the exemptions on this problem, arguing that the network-separation rule kept banks from running the AI tools they needed to detect threats ^[10].

The record counts run opposite to the dwell times. Adding every reported figure gives roughly 68,292 exposed records of mixed kinds, counting customers, corporate records, outsourced developers and loan agents together ^[19]. Shinhan's 25,727 and Yegaram's 40,000 make up about 96% of that ^[20]. KB Kookmin and Hana together lost 208 ^[21].

Both camps can use these numbers. The deregulators' reading is that 42 and 68 hours of undetected access is the case for AI detection inside the wall. The other reading is that the attacker brought AI too. Analysts found a console string naming ARTEX on servers tied to the Shinhan attack, and the tool won an offensive-security contest run by Baidu's security response center this year ^[3]. The FSC had that second reading on its agenda before the breaches: Vice Chairman Kwon Dae-young convened a roundtable on advanced-AI security risks in May ^[18].

The account does not say which of the seven firms held first-round exemptions, or whether any breached system was reachable because of one. At Shinhan the way in was the identity checks on a loan-agent service ^[14]. An institute official said the tool did not act alone, and that the internal employee and partner systems the hacker reached had been "managed less rigorously" than services offered to the public ^[17]. Both describe weak access controls. The rule under review governs whether internal business systems are physically walled off from the internet ^[8].

The pause also defers less than the 75 figure implies. The account describes the first round as covering 49 firms, each with a one-year exemption ^[11], and also says the number chosen was to rise from 10 to as many as 15 ^[12]. Those counts do not reconcile. On either reading, the second round would have added 26 eligible firms ^[22] and no more than 15 selections. Instead of picking them on October 7, FSC staff are on containment ^[13].

From here the FSC can resume selections on the same terms once the review closes, run a smaller round, or bring exemptions back with conditions on partner and employee systems. I'd expect the third, because the regulator has said it still backs the policy ^[13] and the institute placed the weakness in those systems ^[17]. The counter-case has history. In 2017 WannaCry left Korean finance largely unscathed because malware could not reach isolated networks ^[9]. A regulator could take that as reason to hold the wall at the first-round bar of 10 trillion won in assets and 1,000 staff ^[11]. If forensic findings put the breached systems inside exempted networks, the pause becomes a rollback and this view is wrong.