When AI makes breaking in cheap, what matters is how much data sits behind each door.
When AI makes breaking in cheap, what matters is how much data sits behind each door.
ARTEX is an open-source AI agent built for penetration testing, and anyone can download it. Between late September and early October, one attacker pointed it at South Korean banks and left with customer data, according to CrowdStrike.
Shinhan Bank and Yegaram Savings Bank reported breaches affecting 25,000 and 40,000 people, Infosecurity Magazine reported, citing The Straits Times. CrowdStrike assessed the attacker was likely Chinese-speaking and financially motivated.
The location matters less than the targets. They were side systems that every North American bank and lender also runs. Nothing about this playbook is specific to Korea.
How did the ARTEX campaign reach bank data?
CrowdStrike found the attacker's tooling sitting in open directories on attacker-controlled servers. Those directories held Claude Code session histories, ARTEX configuration files and Claude memory files. Infosecurity Magazine reports that ARTEX was used mainly to discover vulnerabilities and compromise specific services. It ran on DeepSeek as its main model. The attacker used Claude as a helper, including to ask where to sell Korean breach data on Telegram.
The services it broke into were far from the core banking platform. At one bank, the attacker reportedly breached a loan progress inquiry service used by financial brokers. At another it compromised an employee mobile work-support system.
CrowdStrike put the takeaway plainly. "This activity demonstrates how AI tooling can enable a financially motivated threat actor to conduct multiple intrusions within a short time span."
Why do AI attack agents change the data security math?
Microsoft's Digital Defense Report 2026 found that exploitation of public-facing applications rose from 15% of incidents in 2025 to 24% in 2026, according to Infosecurity Magazine. Microsoft linked part of that rise to attackers using AI to find vulnerabilities. It also warned that AI has compressed data exfiltration and lateral movement from days to minutes.
Put those findings next to the Korean campaign. One person with an agent can probe many systems at once. A broker portal or a field-staff app no longer needs to be a prized target to be worth attacking. It only needs to hold customer data.
Most programs concentrate protection around the systems everyone agrees are critical. Customer data rarely stays there. It gets copied into exports and reports, then onto the file shares and laptops of the people who support each side application. Every copy is one more place an agent can find.
What can data security do when attackers move at AI speed?
Honest answer first. MIND wouldn't have patched a vulnerable loan portal. No data security tool replaces sound application security. What it can do is reduce how much sensitive data an intruder finds and how easily that data leaves.
MIND brings discovery, detection and prevention into one platform, across data at rest and in motion. Against this kind of threat that looks like this:
- Know where customer data has spread. MIND connects to SaaS apps, on-premise file shares, endpoints, email and AI tools. It classifies what it finds by content and context, beyond regex.
- Shrink the footprint. When sensitive data at rest is overexposed, MIND can remove public links, adjust permissions or escalate to the owner.
- Stop it leaving. Real-time prevention on the endpoint and in the browser blocks sensitive data from going where it shouldn't.
- Keep pace without more headcount. The MIND Autonomous Data Security Analyst builds classifiers, investigates issues and takes action where allowed.
When attackers work in minutes, the controls minding your customer data need to act without waiting for an analyst to get through the queue.
How should security leaders respond to the ARTEX bank breaches?
Start with an inventory. List the portals and internal tools that hold customer records. Then check where their exports end up.
That inventory is worth doing now. In Microsoft's data the US took 25.5% of attacks, the highest share of any country, according to Infosecurity Magazine.
Speed only helps if your team trusts what it's seeing. Richard Reinders put it simply.
“When an alert comes from MIND, we know for a fact it's worth following up on. That's hugely valuable.”
Richard Reinders
VP of Information Security, Gravity Payments
Book a demo to see where customer data has spread across your environment. Deployment takes minutes and insights arrive the same day. That's DLP at AI Speed.
