Estimated reading time: 4 minutes · Last updated:
AI-driven attacks are striking targets across South Korea and Japan — banks, megachurches and retailers have all been hit — as attackers adopt generative tools to automate reconnaissance and phishing. South Korea's tally of 1,236 incidents for the first half of the year represents a 20% year-on-year rise, and TrendAI logged 86 incidents in Japan in September, as first reported by NBC News. The events include breaches at nine South Korean banks and two mega-churches and a recent cluster that affected Daiwa Securities, SoftBank and Lawson in Japan. Choi Kyoungjin said AI lowers the bar for attackers by performing tasks that once required specialist skills.
“AI doesn’t get tired … My view is that Japan is essentially being subjected to carpet bombing,”
Nobuo Miwa, president of S&J Corp.
Key takeaways
- Scope of attacks: South Korea logged 1,236 cyber incidents in the first half of the year, a 20% increase from the same period a year earlier.
- Targets named: Nine South Korean banks and two mega-churches are investigating recent breaches; Japanese victims include Daiwa Securities, SoftBank and Lawson.
- Japan trend: TrendAI data show Japan had 86 cybersecurity incidents in September, up about 18% from August and 37% from July.
- Tools and attribution: CrowdStrike linked the South Korean bank incidents to a 26-year-old China-based attacker who used a Chinese-developed AI agent and Anthropic's Claude Code.
Table of contents
How AI lowers the bar for cybercriminals
Security specialists say the defining change is automation. Where attackers once needed coding skill and persistence to map networks and craft convincing lures, general-purpose AI can generate exploit checks, scan for flaws and draft phishing text on command. That shift reduces the technical threshold for many operations and speeds up campaigns.
Security teams face parallel problems: AI-generated activity can mimic legitimate traffic and create a high volume of alerts to investigate. Choi Kyoungjin, who leads Gachon University's Center for AI, Data and Policy, said general-purpose models enable ordinary users with malicious intent to ask the system to search for vulnerabilities and to automate much of the work.
AI lowers the bar for cybercriminals and compresses the time between discovery and exploitation, security firms warn; the result is faster, cheaper and—because of scale—harder-to-detect attacks.
What unfolded in South Korea and Japan
The incidents cover a wide range of techniques and targets. South Korean authorities are investigating breaches at nine banks and two megachurches; CrowdStrike has linked at least the bank break-ins to a 26-year-old attacker based in China who combined a Chinese-built AI agent with Anthropic's Claude Code. South Korea's government figures show server intrusions declined, while distributed denial-of-service attacks rose 56.7% and reported ransomware cases increased 76.8%.
In Japan the tally of cybersecurity incidents has climbed through the year. TrendAI recorded 86 incidents in September, an increase of about 18% from August and 37% from July, signaling a sudden acceleration. Targets have included brokerage, telecom and retail firms, illustrating that attackers are probing multiple sectors rather than focusing on a single vertical.
Industry and regulator responses so far
Responses blend operational steps and new regulation. South Korea's Financial Services Commission has instructed industry bodies, supervisors and executives at affected firms to perform a 12-point cybersecurity self-assessment. In Japan, digital transformation minister Toshiharu Furukawa convened a ministerial meeting and the National Cybersecurity Office said it plans to issue warnings to businesses.
Private-sector firms are also shifting priorities: CrowdStrike and other vendors are urging more rigorous testing and controls, and Fitch analyst Karen Wu warned the incidents could lead to regulatory penalties, customer compensation costs and a sector-wide rise in cybersecurity spending. Developers of major AI models including Anthropic and Google have similarly warned that AI-assisted attacks are already appearing globally.
| Target | Location | Detail |
|---|---|---|
| Nine banks | South Korea | Under investigation; CrowdStrike linked bank incidents to a China-based attacker |
| Two mega-churches | South Korea | Investigating cyberattacks |
| Daiwa Securities, SoftBank, Lawson | Japan | Part of recent surge in incidents |
How the situation could evolve
The case for
- Regulatory pressure and mandatory self-assessments could force faster adoption of multi-factor authentication, segmentation and more frequent penetration testing.
- Vendors and cloud providers issuing model-use guidance and detection tools may raise defenders' automation capabilities to match attackers.
The case against
- Wider availability of AI agents and code-generation frameworks could sustain higher attack volumes and push smaller organisations beyond their detection capacity.
- Stolen data from current breaches could fuel targeted smishing or phishing campaigns, magnifying the eventual financial and reputational impact.
What to be careful about
- Regulatory penalties and customer compensation costs for breached financial firms, as flagged by Fitch's Karen Wu.
- A surge in credential-based fraud and SMS 'smishing' using stolen contact lists derived from these intrusions.
- A capacity gap: defenders lacking AI-augmented detection may be overwhelmed by high-volume, automated probing.
The bottom line
The recent wave of intrusions in South Korea and Japan shows how quickly attackers adapt when tools cut technical barriers. Reported figures—1,236 incidents in South Korea in the first half and 86 incidents in Japan in September—signal a step change in volume and variety. Security firms urge stricter controls and testing, and regulators have moved to tighten oversight with self-assessments and warnings. Whether those steps narrow the attackers' advantage will depend on how rapidly defenders deploy automated detection and harden systems against credential theft and high-volume exploitation driven by AI.
What to watch
- Watch for the National Cybersecurity Office's planned warnings to businesses; no date has been set.
- Watch for the completion and publication of South Korea's Financial Services Commission 12-point cybersecurity self-assessment by industry bodies; no date has been set.
Frequently asked questions
How many cyber incidents have South Korea and Japan reported this year?
Authorities recorded 1,236 cyber incidents in South Korea during the year's first six months, up 20% year-on-year; the monitoring firm TrendAI reported 86 incidents in Japan in September, about 18% more than August and 37% above July.
Have investigators linked the breaches to AI tools?
Investigations are ongoing, but CrowdStrike said a 26-year-old China-based attacker used a Chinese-developed AI agent and Anthropic's Claude Code in the South Korean bank incidents, and several security firms say AI is being used to automate scanning and phishing.
What regulatory steps have been taken in response?
South Korea's Financial Services Commission ordered a 12-point cybersecurity self-assessment for industry participants, and Japan's digital transformation minister Toshiharu Furukawa convened a ministerial meeting; the National Cybersecurity Office plans to issue warnings to businesses.
Related reading
