Cybersecurity in financial services, week ending 16 October 2026

Week ending 16 October 2026 · 40 sources

AI agents hit Korean lenders as supervisors harden cyber expectations

CrowdStrike said a China-based actor likely used an AI agent to hack South Korean banks, and Korea's FSC ordered bank-wide checks 12. In London, the Bank of England told banks to prepare for AI-enabled cyber breaches 3.

Which way the market is moving

AI-agent attacks hit South Korean financial firms

CrowdStrike said South Korean banks were likely hacked by a China-based actor using an AI agent, in attacks that exposed 100,000 records across 16 financial firms 16.

CrowdStrike said South Korean banks were likely hacked by a China-based actor using an AI agent 1. The Korea Times reported AI-driven attacks hit 16 financial firms and exposed 100,000 records, and a regulator said personal information is presumed to have leaked from 16 institutions 610. The Straits Times reported a link to a Chinese DDoS group 11. The developer of ARTEX, the tool tied to the attacks, pulled it from public GitHub 12.

Korea's FSC ordered bank-wide checks 2. SBS reported that Yegaram Savings Bank downplayed a breach involving SSNs and addresses while keeping customers in the dark 13. The Korea Times reported deposits fell after the attacks as banks raced to ramp up AI defences 14.

What it means: AI tooling shortens the gap between an exposed weakness and a working intrusion, and the Korean case shows customer trust and deposits can move quickly afterwards. Institutions should test detection, containment and breach notification against faster, higher-volume intrusion attempts.

Questions for vendors:

  1. How does your detection distinguish automated, AI-driven intrusion activity from ordinary scanning?
  2. What is your typical time from first alert to containment for financial services clients?
  3. Did your platform detect activity linked to the South Korean campaign, and what indicators did you publish?

In the registry: Cybersecurity Solutions (ITS (International Turnkey Systems)), Employee Information Security (Ncontracts), Zscaler Private Access (ZPA) (Zscaler)

Supervisors set AI and cyber expectations

The Bank of England warned banks to prepare for AI-enabled breaches as New Zealand, US and European regulators set out or stepped up AI and cyber scrutiny 345.

The Bank of England warned banks to prepare for AI-enabled cyber breaches 315. Bank of England and IMF leaders warned cyber threats could undermine trust in the financial system, with Finextra reporting concern that consumers could revert to keeping money in a shoebox 1617. In New Zealand, the RBNZ and FMA set out supervisory expectations on cyber risks associated with frontier AI 4.

US and European regulators are stepping up scrutiny of AI safeguards, Chinese models and cybersecurity, with AI agents flagged as a possible new risk to banks 5. The Financial Times reported Japan declared a cyber space emergency as attacks soared 18. A New Zealand stress test found banks withstood an oil shock, recession and cyber attack 19.

What it means: Supervisors are likely to ask how AI models and agents, including third-party and foreign-developed ones, are inventoried, governed and monitored. Cyber scenarios are also becoming a standard part of resilience and stress testing.

Questions for vendors:

  1. Which AI models, including those from foreign developers, are embedded in your product, and can we disable them?
  2. What logs do you keep of actions taken by AI agents in our environment?
  3. How does your product support severe but plausible cyber scenario testing?

In the registry: RadiantOne Platform (Radiant Logic), Cloud Authentication (OneSpan), HYPR Adapt (HYPR)

Mobile banking malware and impersonation fraud

The Hirudo Android trojan replaces banking apps with patched versions that bypass their own security checks, as fraud pressure rose in Spain and the UK 202122.

ThreatFabric disclosed Hirudo, an Android banking trojan that replaces legitimate banking apps with patched versions built to bypass their built-in security checks 202324. A new P7 variant of the DarkSword iOS exploit kit adds crypto wallet data theft and remote commands 25. Spanish banks reported a 150% spike in fraud, with fraud from stolen devices surging 21.

Microsoft disrupted a criminal marketplace behind more than a billion scam messages, with financial services among the targeted sectors 26. Four in five finance leaders reported AI fraud attempts 27. Identity verification firm Identomat warned that impersonation fraud is putting UK retirement savings at risk 22.

What it means: Security checks inside a banking app cannot be relied on alone if the app itself is swapped out, so server-side and device signals matter. Super funds and wealth managers face the same impersonation risk on withdrawal and transfer instructions as banks do on payments.

Questions for vendors:

  1. How does your mobile protection detect a repackaged or patched copy of our app?
  2. What server-side signals do you provide when client-side checks have been bypassed?
  3. How do you verify high-value instructions, such as pension transfers, against voice or video impersonation?

In the registry: Developer Assist Agent (Checkmarx), Employee Information Security (Ncontracts), Nessus (Tenable)

Exploited edge devices and operational technology

Attackers chained three Ivanti VPN zero-days and exploited AhsayCBS backup flaws, while the ACSC warned on OT and edge device risks 92829.

Attackers chained three Ivanti VPN zero-days for root access, with one flaw still awaiting a fix 9. Ahsay released new fixes for two exploited AhsayCBS flaws after incomplete patches, which attackers used to drop web shells and cryptocurrency miners 28. CISA added seven exploited vulnerability entries this week, including Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, Ivanti Connect Secure and Microsoft Windows F.

Hackers exploited a firmware flaw to heat supermarket fridges in France, with fires reported across hundreds of stores 3031. The ACSC issued an alert on risks to operational technology and edge devices, including refrigeration and cooling 29. Claroty found Australian and NZ firms' OT losses average $2m per incident 32.

What it means: VPN gateways, backup consoles and building systems often sit outside normal patch cycles yet give direct access to core networks. Institutions should confirm asset inventories cover them and that compensating controls are in place when fixes lag or prove incomplete.

Questions for vendors:

  1. How quickly do you ship fixes for actively exploited flaws, and how do you confirm a patch is complete?
  2. Can your exposure tooling discover backup consoles, VPN appliances and building management systems?
  3. What compensating controls do you recommend while a zero-day remains unpatched?

In the registry: Developer Assist Agent (Checkmarx), Zscaler Private Access (ZPA) (Zscaler), RadiantOne Platform (Radiant Logic)

Post-quantum migration moves into practice

The NCSC published post-quantum TLS configuration recommendations and said now is the time to migrate 7.

The NCSC published its recommendations for configuring post-quantum cryptography in TLS and said now is the time to migrate 7.

IonQ announced an all-stock acquisition of cybersecurity firm Elisity worth up to $1.3 billion, framed as bridging zero trust and quantum security 338. Yahoo Finance UK described the deal as expanding IonQ's quantum security platform 34. BTQ Technologies will secure MoonPay Korea's quantum-ready stablecoin network 35. Together these moves bring quantum computing firms directly into network security and payments infrastructure deals 835.

What it means: Migration starts with knowing where TLS and keys are used across internal systems and suppliers. Vendor quantum claims can now be tested against published configuration guidance such as the NCSC's.

Questions for vendors:

  1. Which post-quantum key exchange options does your product support in TLS today, and what is the roadmap?
  2. Can you provide an inventory of where your product relies on quantum-vulnerable algorithms?
  3. How will your product change if acquired by or integrated with a quantum security platform?

In the registry: Digital forensics and incident response (Gridware), RadiantOne Platform (Radiant Logic), Tokenization (Futurex)

Regulation and supervision

Sources

  1. Investing.com, 2026-10-09: South Korean banks were likely hacked by a China-based actor with an AI agent, CrowdStrike says By Reuters
  2. FinTech Global, 2026-10-13: Korea’s FSC orders bank-wide checks after AI cyberattacks
  3. Reuters, 2026-10-15: BoE warns banks to prepare for AI-enabled cyber breaches
  4. Finextra (security), 2026-10-15: New Zealand regulators set out cyber and AI risk expectations
  5. Yahoo Finance, 2026-10-15: AI Agents Could Pose New Risks to Banks: US, European Regulators Step Up Scrutiny of AI Safeguards, Chinese Models and Cybersecurity: Report
  6. The Korea Times, 2026-10-14: AI-driven cyberattacks hit 16 financial firms, expose 100,000 records
  7. NCSC, 2026-10-15: Post-quantum updates to our TLS guidance
  8. BankInfoSecurity, 2026-10-12: IonQ Buys Elisity to Bridge Zero Trust, Quantum Security
  9. iTnews, 2026-10-13: Attackers chain three Ivanti VPN zero-days for root access
  10. Korea JoongAng Daily, 2026-10-14: Personal info presumed to have leaked from 16 financial institutions: Regulator
  11. The Straits Times, 2026-10-11: AI-powered attacks on South Korean financial sectors linked to Chinese DDoS group: Report
  12. Startup Fortune, 2026-10-09: Developer of hacked bank tool ARTEX pulls it from public GitHub
  13. SBS 뉴스, 2026-10-09: Yegaram Savings Bank Downplayed Data Breach Involving SSNs and Addresses While Keeping Customers in the Dark
  14. The Korea Times, 2026-10-11: Banks race to ramp up AI defenses as deposits fall after cyberattacks
  15. PYMNTS.com, 2026-10-15: BoE Warns Banks Against AI Cybersecurity Risks
  16. The Guardian, 2026-10-14: Bank of England and IMF bosses warn of cyber threat to trust in financial system
  17. Finextra (payments), 2026-10-14: BoE and IMF warn of cyber threat to banking system
  18. Financial Times, 2026-10-09: Japan declares cyber space emergency as attacks soar
  19. BusinessDesk | NZ, 2026-10-14: Banks withstand oil shock, recession and cyber attack in stress test
  20. ThreatFabric, 2026-10-14: Hirudo: From Fake Updates to Patched Banking Apps
  21. Finextra (payments), 2026-10-14: Spanish banks report 150% spike in fraud
  22. FinTech Global, 2026-10-15: Impersonation fraud puts UK retirement pots at risk
  23. The Hacker News, 2026-10-14: Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
  24. BleepingComputer, 2026-10-14: Hirudo Android malware replaces banking apps to evade security checks
  25. The Hacker News, 2026-10-11: P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
  26. Help Net Security, 2026-10-15: Microsoft disrupts phishing network behind more than a billion scam messages
  27. International Business Times UK, 2026-10-09: Four in Five Finance Leaders Report AI Fraud Attempts as Deepfake Fears Grow
  28. The Hacker News, 2026-10-15: AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
  29. ASD's ACSC (alerts), 2026-10-14: Protecting operational technology and edge devices
  30. iTnews, 2026-10-12: Hackers exploit firmware flaw to heat supermarket fridges
  31. Insurance Business, 2026-10-12: Fires reported as hundreds of French supermarkets hacked
  32. Insurance Business, 2026-10-09: Australian and NZ firms’ OT cyber losses average $2m per incident, Claroty finds
  33. Yahoo Finance, 2026-10-12: IonQ Announces Acquisition of Cybersecurity Firm Elisity in All-Stock Deal Worth Up to $1.3 Billion
  34. Yahoo Finance UK, 2026-10-12: IonQ expands quantum security platform via $1.3B acquisition of Elisity
  35. The Globe and Mail, 2026-10-10: BTQ Technologies to Secure MoonPay Korea’s Quantum‑Ready Stablecoin Network
  36. NCSC, 2026-10-12: Help the NCSC understand how organisations approach external attack surface risk
  37. Krebs on Security, 2026-10-14: U.K. Sanctions Cryptomus for RU Money Laundering
  38. Professional Planner, 2026-10-12: Fortnum Private Wealth pays $1.35m to resolve cyber case
  39. The Economic Times, 2026-10-14: Cyberattacks affect 20 financial institutions; CERT-In warns on API vulnerabilities and security measures
  40. American Banker, 2026-10-09: America's Credit Unions launches new cybersecurity hub

About cybersecurity software

Cybersecurity vendors protect an institution's systems and data: identity and access, threat detection, security operations and data protection.

Browse the products in the registry

Get the market overview every Monday: subscribe to the Vederca newsletter.