In the early hours of September 29, an attack that began on Shinhan Bank’s loan‑recruiter mobile page spread to seven institutions—including banks, savings banks, and a capital company—within four days. Approximately 66,000 individuals and about 2,200 corporate records were exfiltrated. Traces of the attack revealed the Chinese‑based AI penetration‑testing tool “ARTEX.”
But these firms are not ones that neglect security. They hold certifications, conduct annual vulnerability analyses and assessments, and even contract white‑hat hackers for penetration testing. So what was missing?
1. Our Security Operates by Checklists
The backbone of corporate security in Korea is certification and regular inspections. ISMS‑P checks whether an organization has policies, structures, access controls, encryption, and log management across 101 criteria—comprising 16 management systems, 64 protective measures, and 21 personal‑data‑handling items.
Our Tech DD's 'AI 공격 대비 점검' focuses precisely on this area. We monitor external exposure surfaces, resistance to automated attacks, transmission segments and security headers, and the exposure status of AI functionalities in a read‑only mode—not via penetration testing. Within 24 hours of receiving the data, we provide a report that includes evidence and recommended remediation steps. If you’re curious how your organization appears from an AI attacker’s perspective, feel free to contact us.