The report
South Korea's Financial Services Commission reported on October 14 that cyber incidents had been identified at 16 financial-sector companies, with roughly 100,000 personal-information records potentially exposed. The regulator said companies were continuing their checks, so the count could change. Bank passwords and payment-card data had not been confirmed among the leaked fields.
The same announcement reported a second, different number: of 555 companies reviewed through a security checklist, 130 had some control deficiencies. Those are inspection findings, not 130 further compromises.
Earlier independent research connected portions of the financial-sector incidents with ARTEX-assisted offensive activity. But the regulator is still examining whether the 16 incidents share an operator. It would be unsupported to attribute every institution and record to one AI agent or actor. The existing ARTEX investigation now includes the regulator's expanded count with that limitation preserved.
Three populations, not one campaign count
The regulator's 16 affected institutions, approximately 100,000 potentially exposed records, and 130 institutions with checklist deficiencies measure different things. The last figure comes from 555 checklist assessments; it is not a victim count. The approximately 100,000 records are a data-exposure estimate, not 100,000 confirmed fraudulent uses. The common-actor investigation is a separate attribution question.
The ARTEX record is based partly on exposed attacker-side agent files. Those files illuminate one AI-assisted intrusion workflow, but cannot by themselves establish that all incidents in the regulator's disclosure used ARTEX. The defensible update is the wider regulator-confirmed incident scope with the AI attribution restricted to the evidence actually linked to the operator.