SEOUL/TOKYO — Companies in South Korea and Japan are scrambling to shore up their cyber defenses after a wave of attacks that cybersecurity experts say illustrates how artificial intelligence may be lowering the bar for criminals with limited technical skills.

Nine South Korean banks and two mega-churches are probing cyberattacks that may have involved AI tools. In Japan, companies including Daiwa Securities, SoftBank Corp and the Lawson convenience store chain have been hit by a recent surge in cyber incidents. The Japanese targets span securities trading, telecommunications and convenience retail — sectors that handle large volumes of consumer transactions and personal data every day.

Authorities are still working to determine whether and how AI was used in many of the breaches. But cybersecurity specialists say the technology is enabling attackers to automate tasks ranging from scanning for software vulnerabilities to crafting phishing campaigns, making cybercrime faster, cheaper and more difficult to detect.

"AI doesn't get tired… My view is that Japan is essentially being subjected to carpet bombing," said Nobuo Miwa, president of Tokyo-based cybersecurity firm S&J Corp.

Japan recorded more cybersecurity incidents in the first nine months of the year than in all of last year, according to data from TrendAI. Incidents rose to 86 in September, up about 18% from August and 37% from July.

The increase suggests attackers have crossed a threshold in "effort, motivation and technical capability," while AI has largely erased the language and other barriers that once hindered foreign hackers, Miwa said.

US cybersecurity company CrowdStrike said a suspected 26-year-old, China-based attacker behind the South Korean bank incidents would probably not have been able to carry out the campaign without AI assistance. The individual, whom CrowdStrike assessed was pursuing financial gain, used a Chinese-developed AI agent and Anthropic's Claude Code, an agentic coding tool, according to the company.

"While (the hacker's) capabilities were not terribly sophisticated they were effective," said Adam Meyers, CrowdStrike's senior vice president of counter adversary operations.

Hard-to-Detect Attacks

AI-powered tools are also making it harder for defenders to spot suspicious behavior, said Choi Kyoungjin, director of the Center for AI, Data and Policy at Gachon University near Seoul.

"With general-purpose AI models, even ordinary users with malicious intent can ask the system to look for vulnerabilities and it will do much of that work for them," he said.

South Korea reported 1,236 cyber incidents in the first half of the year, up 20% from a year earlier. According to government data, server hacking cases fell, while reports of distributed denial-of-service (DDoS) attacks and ransomware rose 56.7% and 76.8%, respectively. The shift matters because ransomware can lock up systems or data until a payment is made, while DDoS attacks can knock online services offline by overwhelming servers with traffic.

Meyers said the South Korean bank incidents underscored the need for stronger security controls and more rigorous testing as AI evolves. "The genie is out of the bottle, so to speak."

Although the breaches have not yet resulted in material financial losses, risks could increase if stolen data is used in phishing or similar text-message "smishing" campaigns, Karen Wu, senior analyst at Fitch, wrote in a note.

"We expect the incidents to result in regulatory penalties, customer compensation costs, and a sector-wide increase in cybersecurity spending," Wu said.

Defenses Need Their Own Breakthrough

Warnings about AI's growing role in cybercrime are coming from the technology's developers themselves. Alphabet's Google and Anthropic have both cautioned that AI-assisted attacks are becoming more common globally.

"At this point, we can assume that all threat actors are using AI in some capacity and their operations have benefited," John Hultquist, chief analyst at Google's Threat Intelligence Group, said last month.

Regulators in Japan and South Korea have begun to respond. South Korea's Financial Services Commission has directed financial industry associations, regulators and affected executives to complete a 12-point cybersecurity self-assessment.

In Japan, digital transformation minister Toshiharu Furukawa convened a meeting of ministries and agencies on Thursday following the recent attacks, while the National Cybersecurity Office plans to issue warnings to businesses.

For now, investigators' findings on whether AI played a role in the breaches, along with the rollout of the self-assessments and Japan's planned business warnings, are the key developments to watch as both governments adapt to the shifting threat.

Miwa said he expected elevated levels of cyberattacks to persist.

"The attackers have experienced a breakthrough that has rendered many of the old assumptions obsolete," he said. "Our defenses need their own breakthrough as well."

— Reuters