October 23, 2026
SBI Data Breach and Korea’s AI-Linked Bank Hacks: The Side Door Is the New Front Door
State Bank of India confirmed customer records leaked on the dark web, weeks after Shinhan, KB Kookmin and Hana were breached in attacks…
By Web Dance Pty. Ltd
4 min read
State Bank of India confirmed customer records leaked on the dark web, weeks after Shinhan, KB Kookmin and Hana were breached in attacks where an AI hacking tool left traces. The pattern is the same: the money was safe, the side systems were not.
"Customer balances are completely safe."
That was the message State Bank of India, the country's largest lender, posted on X this week. It's the line every bank reaches for after a breach. It's probably true. And it misses the point.
On Wednesday 21 October, SBI said in an exchange filing that a cyberattack had led to the disclosure of 3,897 customer records on the dark web, according to Xinhua. The records included names, mobile numbers, dates of birth, gender, email addresses and home addresses. Asia Insurance Post reported the exposed data also included branch and customer identification numbers, and loan and lead record details.
Nobody's money moved. But nearly 4,000 people now have their identity details in the hands of strangers, which is exactly what a scammer needs to sound like your bank on the phone.
What SBI has said, and what it hasn't
SBI said it activated its cyber incident response and containment protocols and brought in an independent cybersecurity agency to assess the "alleged compromise." It said the leak should not materially affect its core operations, financial performance or business continuity. A preliminary review looked at about 375,000 dark web records to find the ones belonging to its customers.
What we don't know is how it happened. The cause has not been confirmed, and SBI is still investigating the source and extent of the exposure. There is no public evidence linking the SBI breach to AI tools or to the PHP2Shell flaw that sent websites offline around the world the same week. Anyone telling you otherwise is guessing.
SBI is not alone in feeling the pressure. Asia Insurance Post noted that in a Reserve Bank of India survey of 43 banks and shadow lenders, nearly one-third reported a moderate or significant rise in cyber risks.
Hiring an outside firm to check is the right call. It also reflects a simple truth for every organisation: after a breach, your own word is not enough.
Seoul, three weeks earlier
If the SBI story sounds familiar, look at South Korea.
In the first days of October, several of Korea's biggest banks disclosed breaches, the Korea Herald reported on 2 October. Shinhan Bank said an attacker bypassed identity checks in a mobile inquiry service used by loan agents, exposing about 25,000 customers' names, phone numbers, annual incomes and loan limits. KB Kookmin Bank said 119 customers were exposed through an employee mobile support system. Hana Bank said 89 customers were exposed through ODS, its sales support system. BNK Financial Group reported 11 records of outsourced staff.
The banks moved quickly once they knew. Shinhan blocked external IP addresses and suspended the affected service. KB Kookmin blocked the affected server and access routes. Hana alerted the Financial Supervisory Service.
Hana stressed that "the system is separate from internet and mobile banking transaction systems." Again: the vault held. The side rooms didn't.
By 16 October, Security Magazine counted 16 known affected institutions, including savings banks, lenders and virtual asset firms, with about 100,000 personal records leaked in what it called a breach by an "AI-assisted attacker."
The AI fingerprints
Here is where it gets uncomfortable. Analysts found traces of an AI penetration-testing tool called ARTEX AI on a server suspected of being linked to the Shinhan attack, the Korea Herald reported. At the time, neither the bank nor financial authorities had confirmed it was used.
ARTEX was an open-source, AI-driven multi-agent penetration-testing system, the kind of tool security teams use to probe their own defences. After the attacks, its developer said, according to a published account, that "in view of the reality of tool abuse," the project would no longer be updated and would become closed source. The same account says Korea's Financial Security Institute assessed that the AI "did not act independently without human involvement."
That detail matters. On that assessment, this was not a robot going rogue. It was a person using a tool that made finding weak spots faster and cheaper. Korea's Financial Services Commission held an emergency meeting and ordered checks of externally accessible systems, plus stronger authentication and tighter access controls.
The pattern boards keep missing
Put the two stories side by side and the shape is clear. The core banking systems, the ones with the money, held up. The breaches came through loan agent portals, employee support apps, contractor pages and customer lead records. Systems that sit at the edge, often built quickly, often handed to third parties, often left off the main security review.
Patrick Harr, chief executive of DataVisor, told Security Magazine: "Fraud is becoming polymorphic: attackers change identities, documents, devices, and behaviors faster than fixed defenses can adapt."
AI tools make those edges far easier to find. They can tirelessly test thousands of forgotten pages that a human attacker would never bother with.
The PHP2Shell scramble showed the same thing from the defensive side. Japan's largest bank, MUFG, temporarily suspended some webpages and services as a precaution. That is what good preparation looks like: knowing which edge systems to switch off, and being able to do it fast.
Questions for the boardroom
Do we have a full list of every system that touches customer data? Including loan broker tools, sales apps and contractor portals.
Are our edge systems tested as hard as our core? Attackers with AI tools will test them either way.
How quickly could we tell customers what leaked? Customers will expect days, not weeks.
Who checks our checking? After a breach, an independent review carries weight. Before a breach, it carries more.
The vault is not the bank
"Customer balances are completely safe" is a fine sentence. It just answers a question customers are no longer only asking. They also want to know whether their details are safe, and whether anyone outside the bank has checked.
At Web Dance, that is the thinking behind AISOF, the AI Integrity and Secure Operations Frameworks we own and issue. Outcomes are decided by an approved assessor, never by the organisation itself.
Lock the vault, by all means. Then go and check the side door.
Web Dance Pty. Ltd is an Australian company based in Sydney. We own and issue AISOF®, the AI Integrity and Secure Operations Frameworks, a family of assurance frameworks covering organisational AI governance, named AI products and five sector specific tracks. AISOF is a registered trademark of Web Dance Pty. Ltd, registered with IP Australia. More at aisof.org.