Social media videos and posts have recently stitched together banking incidents from around the world, creating the impression that AI-driven cybercriminals simultaneously targeted financial institutions across 15 countries.
While banking-related cyber incidents have raised genuine concerns, the cases involve different dates, causes and levels of confirmation. Some are cyberattacks, others involve phishing, internal security failures or even banking insolvency.
Paraguay: A banking crisis, not a cyberattack
Paraguay's crisis involved Ueno Bank, which was placed under central bank intervention after its solvency ratio fell below half the legally required minimum. The bank, which reported around three million customers, faced scrutiny over lending to companies linked to its controlling shareholder. Customers temporarily lost access to their accounts, while the authorities initiated an orderly resolution process.
The crisis escalated into a political controversy, with President Santiago Peña offering to resign on Nov 5. However, both chambers of Congress rejected his offer.
Taiwan: A bank-side security failure
Taiwan's Bank SinoPac experienced a genuine cyber incident. On Nov 3, 427 unauthorised transactions totalling NT$41.76 million affected 419 customers. The bank initially attributed the transfers to a software glitch but later confirmed that external hackers had exploited security settings at a supplier of its new banking system. The bank said all affected customers had been reimbursed, with no evidence of customer data leakage.
Bank terkena seragan Cyber hacks di 15 Negara secara bersamaan.. Ada Indonesia! https://t.co/WREPCI7Rrh
— Brahim 🙃 (@Brahim_maldini) November 6, 2026
France: The bank's own money was stolen
France's Crédit Mutuel Arkéa confirmed a cyberattack, but its customers were not the target. Hackers reportedly exploited a third-party service provider's platform and used the bank's own account to initiate fraudulent transfers. The reported loss is approximately €100 million, although some estimates place it higher. The bank said customer assets were unaffected. The stolen funds were subsequently traced through cryptocurrency platforms, and recovery efforts were initiated.
South Korea and Japan: The AI connection
South Korea and Japan are at the centre of growing concerns about AI-assisted cybercrime.
Cybersecurity investigators at CrowdStrike linked attacks against at least nine South Korean financial institutions to an unidentified threat actor using ARTEX, a Chinese-developed open-source AI penetration-testing tool, alongside large language models. The campaign reportedly involved automated reconnaissance and attacks that resulted in data being stolen. South Korean authorities are investigating the breaches.
In Japan, cybersecurity incidents have also increased sharply. According to MM Research Institute, the country recorded 468 publicly disclosed cyber-related data-leak incidents between January and Sept 2026, compared with 428 throughout 2025. The number had reached 661 by the end of Oct. However, these figures cover Japanese organisations generally, not just banks, and not every incident has been attributed to ARTEX.
Japan's banking sector is facing additional pressure. On Nov 5, SMBC Consumer Finance disclosed unauthorised access to its guarantee-system infrastructure, potentially exposing personal information belonging to up to 320,118 people associated with 15 financial institutions. The compromised system was used for loan-guarantee services, rather than being the core banking system of all 15 institutions.
On Nov 6, Japan's Financial Services Agency issued a warning to financial institution customers, advising them to avoid suspicious links, stop reusing passwords, and use phishing-resistant multi-factor authentication. Meanwhile, the Bank of Japan's October Financial System Report acknowledged that advanced AI could increase the speed and scale of cyberattacks, while maintaining that Japan's financial system remained broadly stable.
Other countries: Different attacks, different vulnerabilities
Vietnam: Hackers allegedly remained inside a bank's systems for months before stealing its own funds overnight. The precise incident and figures still require independent verification.
Nepal: The central bank advised banks and financial institutions to take vulnerable websites offline as a precaution following serious PHP security vulnerabilities. Separately, 22 complaints were reported in a fake-KYC scam involving NPR 4,987,333. Police arrested three suspects.
Indonesia: Cybercriminals targeted 6,609 Bank Jambi customer accounts on February 22, 2026, with reported losses of Rp144.82 billion, approximately US$8.8 million. Police said the stolen funds were converted into cryptocurrency and transferred to overseas wallets.
Singapore: Criminals used forged payment instructions and an authorisation letter to divert US$12.8 million to Cambodia. The Singapore Police Force, Cambodian National Police and OCBC coordinated efforts to recover the entire amount.
Malaysia: A member of the Terengganu royal family filed a civil lawsuit alleging that RM1.985 million was withdrawn without authorisation from accounts at two banks. The allegations have not been established in court.
Sri Lanka: The Ministry of Finance reported a US$2.5 million loss involving a payment intended for Australia. The investigation concerns ten transactions between September 2025 and January 2026, with authorities examining a suspected breach of the ministry's External Resources Department systems. Recovery and investigations remained ongoing.
New Zealand: A police-impersonation scam reportedly hijacked 22 bank accounts and caused NZ$198,000 in losses. However, the specific figures and case details remain independently unverified.
Canada: A former Royal Bank of Canada employee, Ibrahim El-Hakim, was found guilty of three criminal offences after opening at least 43 fraudulent accounts and assisting an organised criminal network. He had been recruited through Telegram.
Mexico: Cybercriminals reportedly used AI tools in operations targeting financial institutions and systems connected to SPEI, Mexico's interbank payment network. Cybersecurity researchers identified compromised credentials and financial-sector targets, but a successful breach of SPEI's central infrastructure has not been established.
Brazil: The Central Bank recorded 99 cyber incidents between January and September 2026, 68 of which were classified as fraud. The figure had already exceeded the 76 incidents reported throughout 2025.
United States: Fourteen people were indicted in Dallas in an alleged SIM-swapping and insider-assisted bank-account takeover operation targeting accounts holding more than US$373 million. The figure represents the combined balances of targeted accounts, not confirmed stolen funds. Separately, a Florida company lost approximately US$6.5 million through 15 fraudulent wire transfers over three days, with more than US$4 million reportedly still missing.
These incidents should not be presented as one coordinated global cyberattack. They involve everything from AI-assisted intrusions and phishing to insider fraud, compromised suppliers, forged payment instructions and institutional failures.
Although such posts show the real fear people have regarding AI, a technology that is rapidly changing their lives without their consent.
Comments