New Wave of Cyberattacks Hits South Korea's Banks and Brokerages

What happened

South Korea's financial sector suffered a new wave of cyberattacks reported on October 28, 2026, according to TechCrunch. This time the targets were brokerage Daishin Securities, asset manager Mirae Asset Global Investments, and crypto exchange Bithumb.

Daishin confirmed that the attack exposed personal data of 38,490 customers: names, emails, and phone numbers. The company notified those affected, is cooperating with authorities, and says it will compensate any losses as required by law.

Mirae Asset and Bithumb also reported separate incidents on Wednesday (the 28th), according to local press, but neither has confirmed so far whether customer data was leaked. The FSC (Financial Services Commission), Daishin, Bithumb, and Mirae Asset had not responded to TechCrunch's requests for comment by the time of publication.

The AI tool behind the earlier wave

This isn't the first time in 2026 that South Korean financial institutions have been attacked. About a month earlier, in September, a series of attacks had already hit banks and other companies in the sector in the country, raising concerns that go beyond traditional banking systems.

Security researchers linked that September wave to a hacker suspected of operating out of China, who reportedly used an AI-based offensive pentesting tool called Artex. Authorities are still investigating whether the more recent October incidents share the same origin or method.

In short: AI pentesting tools automate steps that used to require a specialized human analyst, such as mapping vulnerabilities, chaining exploits, and adapting the attack approach in real time as the defense reacts. This reduces the cost and time needed to build an invasion campaign against high-value targets, such as financial institutions.

Regulator's response and what remains open

South Korea's financial regulator called for stronger cybersecurity measures in the sector, according to authorities in Seoul the same Wednesday. The country also plans to carry out security checks on dozens of private-sector IT systems.

As of TechCrunch's report, there was no official confirmation that the October attacks against Daishin, Mirae, and Bithumb used the same tool linked to the September case. The exact origin of the most recent incidents remains under investigation.

Japan also reported an incident the same week

A day earlier, Japan reported a cybersecurity incident involving GMO Internet, following a series of attacks against Japanese financial institutions. According to TechCrunch, investigators have not yet established a connection between the Japan and South Korea cases, but the wave across two of Asia's largest financial markets reinforces a regional pattern of accumulated cybersecurity fragility over the years.

What this means for those building financial infrastructure in Brazil

The South Korean case is a concrete warning sign for those developing and maintaining financial systems in Brazil, where Pix (Brazil's instant payment system), Open Finance, and API-based banking integrations have grown rapidly in recent years. AI-based offensive pentesting tools aren't exclusive to state-backed groups: as they become more accessible, defense also needs to incorporate AI, not just static firewall or WAF rules.

In practice, this means rethinking some layers common in Brazilian fintech and digital bank architectures:

• Real-time anomaly detection: fraud systems based only on fixed rules (amount limits, time of day, geolocation) become easier to bypass when the attacker also uses AI to vary the attack pattern.
• Exposed API surface: Open Finance multiplied the number of authenticated endpoints between institutions; each new integration is one more point that an automated pentesting tool can scan at scale.
• Incident response and LGPD: the Daishin case shows the playbook any Brazilian company also needs to follow under LGPD (Brazil's data protection law): notify those affected, document the investigation, and be prepared to make amends, not just technically, but also in communication with customers.

The episode still has no closed conclusion, either on the technical side (it's unknown whether Artex or a similar tool was used in October) or on the regulatory side (the outcome of the checks announced by the South Korean government on private systems). For security teams in Brazil, the lesson available today is less about the tool's name and more about the pace: AI-automated attacks against the financial sector are no longer a research hypothesis and are already appearing at real institutions, repeatedly, in the same quarter.