ARTEX Intel中文

Timeline

Korean financial intrusions expand to 16 institutions

Event date2026-09-27 to 2026-10-14
Disclosed2026-10-14
TypeData theft
ConfidenceConfirmed
ARTEX statusARTEX not named
Countries and regionsSouth Korea
SectorsSavings banks, P2P, Crypto assets, Finance

Beyond the first wave of 7, another 9 were confirmed, for a total of 16 institutions and about 100,000 records. The list includes P2P firms, crypto-asset firms and Saemaul Geumgo (MG Community Credit Cooperatives). Information that allows direct fraudulent use, such as account numbers and card numbers, was not confirmed. SBS reported in the same period that data leaked at some institutions included account numbers. The two accounts differ.

Confirmed victims

  • DB Savings Bank
  • OK Savings Bank
  • KDB Capital
  • PFCT
  • Mouda
  • Brightpix
  • Streami (GOPAX)
  • Pravang
  • Saemaul Geumgo (MG Community Credit Cooperatives) Central Federation

Attribution

ARTEX basis
16 is the number of intrusion reports in the same period. The Financial Services Commission (FSC) did not say that all 16 involved ARTEX.
Actor
Financial Services Commission (FSC): whether it is the same actor is "under close review".
Same attacker?
SBS reported on Oct 13 that Saemaul Geumgo (MG Community Credit Cooperatives) and OK are presumed to involve different attackers, with IPs different from the earlier 28. Whether PFCT and Mouda belong to the same attack stream is not confirmed.

Figures and definitions

Institutions16 (FSC, Oct 14)
LeakedAbout 100,000 records (FSC, Oct 14)
Pravang, first incident20 people (MTN, Oct 14); 113 people (CBS NoCut, Oct 31)
DB Savings BankCompany says it blocked the attack; FSC lists it among the 16; News1 estimates 142 people

Related events

Sources (30)