Korea's AI bank hacks came through the side door: lessons for Indian fintech

SEOUL / NEW DELHI: As South Korea investigates a wave of AI-assisted attacks on its biggest banks, one of its leading cybersecurity academics has pushed back on a popular explanation for what went wrong.

The lesson he draws applies directly to India's fintech sector.

The claim

Seungjoo Kim, a cybersecurity professor at Korea University, wrote that most systems hit in the ARTEX-linked breaches were not internal business systems covered by Korea's traditional "network separation" rules.

Instead, they were business systems built for outside access, used by loan brokers, sales staff and partner companies, and poorly managed ones at that.

He rejected the argument that the banks were breached because the financial sector had led the way in relaxing network separation.

Fact check: accurate

The breach disclosures support his reading:

• Shinhan Bank: about 25,700 customers' data exposed through a loan-agent inquiry service
• KB Kookmin Bank: 119 records taken from an employee mobile work-support system
• Hana Bank: 89 records taken from an employee sales-support system

Korean regulators reached the same conclusion.

The Financial Services Commission (FSC) postponed the second phase of its network-separation easing, which lets selected firms use external AI tools for security testing.

It said the delay was to focus on incident response, not a policy reversal.

Officials said the weaknesses were concentrated in the authentication and access controls of exposed support systems.

The key question, they said, is how thoroughly firms applied basic controls at their external touchpoints, not whether network separation was kept.

There is one nuance.

The breaches did hit internal systems for employees, so the Korea Financial Security Institute is recommending a full audit of employee-facing systems reachable from outside.

But the entry points were external portals, not the isolated core.

Why India should pay attention

India's lending and payments ecosystem runs on exactly these side doors.

NBFCs and digital lenders depend on direct selling agents, lending service providers, collection agencies, co-lending partners and fintech integrators, each with its own portal, API key or login.

These systems are often built quickly, owned by business teams rather than security teams, and left running after a partnership ends.

The warning is already live.

On 9 October 2026, CERT-In issued a critical advisory on attackers stealing payment and disbursement API credentials from NBFCs, fintechs and payment providers, then triggering transfers straight to mule accounts.

It cited deprecated APIs, static tokens and missing multi-factor authentication, and flagged the possible use of AI-assisted tools.

The Korean attackers stole data.

The Indian campaign goes straight for the money.

Lessons for Indian fintech

• Map every external touchpoint. Inventory every portal, API and login used by agents, brokers, partners and employees working remotely. Anything not on the list cannot be defended.
• Treat partner and agent portals as crown jewels. A loan-agent lookup page that returns customer data deserves the same scrutiny as core banking.
• Fix authorisation at the object level. Check that every lookup returns only the records that user is entitled to see. Broken object-level authorisation is what lets an automated tool pull thousands of records one query at a time.
• Enforce strong authentication everywhere. Use MFA and short-lived tokens for every external login and API, including legacy and partner systems.
• Decommission what you no longer use. Retired partner integrations, test endpoints and old app versions are prime targets.
• Rate-limit and watch for automation. AI tools probe at machine speed. Velocity limits, bot detection and anomaly alerts on lookup and disbursal APIs raise the attacker's cost.
• Own your partners' security. Under RBI's digital lending rules, regulated entities remain responsible for their lending service providers. Contracts should require security baselines, regular testing and breach reporting.
• Test with the attackers' tools. Run AI-assisted red teaming against external portals and APIs, so weak spots are found before criminals find them.
• Don't blame the policy. Network isolation protects the core. It does not protect systems that were deliberately exposed. Security has to follow the data wherever it is reachable.

The bottom line

Korea's banks were not breached through their vaults but through the side entrances built for brokers and staff.

For Indian fintechs growing through partnerships and APIs, those side entrances are multiplying every day.

Each one needs the same attention as the front door.