South Korean financial authorities are investigating a suspected coordinated cyberattack campaign that exposed personal data at seven financial companies and involved IP addresses linked to the Shinhan Bank hack attempting to access Toss Bank servers 14 times since early this year. More than 67,000 people were affected by leaks involving names, contact details, resident registration numbers, birthdates, annual income and loan limits. Investigators found traces associated with ARTEX AI, a Chinese-language open-source autonomous penetration-testing system, on a server believed to have been used in the attacks, although this does not establish that the attacks originated in China or that AI was responsible for every intrusion. The attacks targeted weaker peripheral systems used by employees, contractors and loan agents rather than core banking networks, with credential stuffing and unpatched vulnerabilities among the suspected techniques. President Lee Jae Myung ordered a thorough investigation and countermeasures, while regulators coordinated emergency sector-wide security measures. The Financial Services Commission said it found no indication that information directly usable for unauthorized payments had been leaked, but warned that compromised data could enable voice phishing and smishing.