Bank customer data leaked, AI threat grows

The leaked information included sensitive personal details such as customer names, contact information, annual income, and loan limits. Financial authorities stated that they have not identified any impact on internet/mobile banking or financial damage so far.

Traces of AI security inspection tools were found on the server suspected of being involved in this attack, but it has not yet been confirmed whether they were actually used in the attack.

Such personal information leaks increase the risk of leading to additional financial crimes like smishing and voice phishing. In particular, Shinhan Bank's loan recruiter inquiry service was targeted.

The scope of security protection must include not only services provided directly to customers but also outsourced partners and employee work systems. The Financial Services Commission has ordered a full investigation and authentication system review for all external access systems.

AI assists in vulnerability analysis, document comparison, and automated tasks, helping attackers not only invent new weaknesses but also find existing unpatched vulnerabilities at very high speeds.

This gives attackers the opportunity to review more internal systems in a shorter time. The UK National Cyber Security Centre has warned that AI can accelerate attacks on unpatched vulnerabilities.

When unusual access occurs with a surge in inquiry volume, the responsible person must immediately verify which account the activity originated from and whether the access was made from a device normally used.

To quickly distinguish between legitimate employee activity and attacker intrusion in this process, connecting login records with device security products is essential.

Just as airports analyze movement by cross-referencing immigration, boarding, and baggage records, security systems must also integrate account-specific and device-specific activity records to understand the context. Only with such connected records can one clearly know what happened at any given moment.

Generative AI plays a role in organizing these collected clues into easy-to-understand explanations for the 담당자 (person in charge) and suggesting records that require further verification. Additionally, the context of the work environment, such as anticipated device replacement, must be reflected in the judgment to reduce false positives.

Microsoft Defender is designed to link signals from accounts, devices, and emails to determine attack incidents. It focuses on identifying and responding to assets used by attackers.

It uses various types of machine learning models, and generative AI works in conjunction with detection capabilities. However, the accuracy and effectiveness in actual deployment environments must be verified by the user.

If older services do not record data or are not integrated with security products, gaps can occur in the data needed for AI analysis. No matter how smart an AI model is, it is difficult to accurately determine the timing of information leakage without basic data.

Security teams must verify AI analysis results by re-examining the basis of AI's judgment and checking whether different users' actions were incorrectly grouped.

Simply shutting down the entire employee service due to high inquiry volume carries a high risk of paralyzing normal customer consultation.

Therefore, security programs must be capable of precise responses, such as limiting activity only for specific accounts or devices. Security teams must review and modify automated actions or exclude important assets from protection lists, maintaining control.

AI must be prevented from misinterpreting sentences in emails sent by attackers as system commands and executing them. This is because attacker sentences could be mixed into records.

Security design that limits AI's access rights and the scope of executable actions through separate authorization controls is essential. The technical completeness of a security company is determined more by the scope of system interconnections and control capabilities than by the performance of AI models.

Microsoft offers environment-linked solutions that group account, email, and device signals into one incident. This method integrates various signals to identify attacks.

CrowdStrike adopts a method where AI first categorizes device alerts, followed by a human approval process. Palo Alto Networks provides a procedure where firewall records, etc., are analyzed in Cortex and lead to actual responses. Ultimately, the competitiveness of a security company is determined by the connectable data, control mechanisms, and how much false judgment can be reduced.