A thread making the rounds on X says hackers are hitting banks in seven countries at once, that this is "what Covid looked like in week 1", and that nobody is calling it a crisis. It lists South Korea, Latin America, Italy, India, Bitget, Japan and Australia, then ends with a call to follow the author for updates.
Financial institutions do face a real, growing AI-driven threat, and central banks are treating it seriously. But the thread blends very different events into one story, and several of its numbers don't match what we could find. We went through each claim. Everything below is based on press reports and security-vendor research, which we link; much of it is secondhand and some investigations are ongoing. We haven't verified anything independently.
The Claims at a Glance
| Claim | Status | Our finding |
|---|---|---|
| South Korea: AI-assisted breaches at 7+ firms | Mostly supported | Reported, AI role still under investigation; the Daishin figure we couldn't confirm |
| Latin America: AI agents vs 400+ targets | Reported | One vendor's research, secondhand coverage |
| Italy: €95M, €36M missing | Partly off | Real, but from February 2026, a fraud and not a hack |
| India, Bitget, Japan, Australia | Not checked | We did not verify these figures |
| G7 drills simulating AI attacks | Supported | Agreed in October 2026 |
| ECB gave banks 4 months | Unconfirmed | One report mentions an end-of-October deadline; no ECB announcement found |
South Korea: AI Suspected, Details Still Moving
This is the best-documented item. Korean outlets report a string of breaches at financial firms, with sources saying overseas attackers used advanced AI tools. In one case, an AI agent is believed to have hacked a mobile work-support system used by bank employees and reached customers' names, phone numbers, addresses and encrypted resident registration numbers. Shinhan Bank's breach is reported as the largest of the group. See Korea JoongAng Daily and The Star.
What we couldn't confirm. The thread says Daishin Securities reported 38,490 customers' data leaked. We found no reporting on that figure. The largest single-firm breach we found was at Yegaram Savings Bank, at about 40,000 customers. The thread's "68,000 people" and "16 firms" figures also didn't turn up in our search. Reporters also stress that the AI's role is still being investigated and attribution is unconfirmed.
Latin America: Claude, Grok and Kimi Agents
Press coverage, based on research from the security firm Straiker, describes a group using a network of AI agents against more than 400 Latin American financial targets, with Grok gathering information, Claude-based agents planning attacks, and Kimi as a fallback when a model refused a step. Anthropic reportedly revoked the credential the group used. Accounts differ on the group's name, so treat the details as unsettled (see this summary). Trend Micro has separately published research on AI-augmented campaigns against Latin American government and financial targets.
The thread says they "got into customer bank accounts". The coverage we found describes attempted and partial intrusions at scale; we couldn't confirm the thread's specific outcome.
Italy: A Fraud, Not a Hack, and Not New
The thread places the Intesa Sanpaolo case alongside this month's incidents. Reports say it happened in February 2026 at Fideuram, Intesa's private bank. Criminals reportedly sent the chairman a WhatsApp message appearing to come from the CEO, and used an AI-cloned voice of a lawyer to push through overseas transfers of about €95 million. Roughly €53-59 million was reportedly recovered with help from Italian, Chinese and Portuguese authorities, and about €36 million is unaccounted for, reportedly moved through overseas accounts and converted to crypto. Intesa says no IT systems were hacked. Sources: Gulf News and Itdaily.
The distinction matters. The defence against deepfake impersonation is process, such as call-backs and dual approval, not a better firewall.
India, Bitget, Japan and Australia
We didn't verify the thread's figures for these: ₹300 crore lost by small Indian lenders, $351 million drained from Bitget, a $50 million demand against a GMO Internet service, and A$4.5 trillion of Australian retirement savings "in the firing line". Crypto-exchange theft and ransom demands are long-standing patterns that predate AI tooling, and some of these entries read as general threat warnings rather than AI-driven attacks. In Japan, we did find a related case: Daiwa Securities disclosed a breach at a contractor, with up to 110,000 clients' data affected and no unauthorized trading detected (see Insurance Journal). Check primary sources before repeating any of these numbers.
What Central Banks Are Doing
This part is real. G7 finance leaders agreed on October 15 to run tabletop exercises simulating frontier-AI cyberattacks, with results feeding into revised incident playbooks and private institutions possibly taking part (Reuters via The Star). The Bank of England's deputy governor said banks can no longer assume their defences are immune to AI-enabled attacks. The thread's claim that the ECB gave eurozone banks four months for defence plans is unconfirmed; one secondary report mentions an end-of-October deadline, and we found no ECB announcement.
Is This Really Like Covid?
Not in any way that helps. Covid spread person to person and followed one exponential curve. These incidents have different attackers, methods and victims. What does connect them is that AI lowers the cost of reconnaissance, phishing and impersonation, so attacks that once needed skilled teams are available to more people. That is a serious trend, and the right response is better controls, not panic. "Nobody is calling this a crisis" is also hard to square with the G7 and the Bank of England saying otherwise.
What Banks and Customers Can Do
For banks and fintechs. Verify large or unusual payments out of band, not on the channel the request came in on. Protect internal tools such as work-support portals and vendor systems as carefully as customer-facing ones, since several cases hit those. Rate-limit and monitor lookups that cycle through values. Rehearse incident response, including AI-assisted social engineering. Check what your suppliers hold, because contractor breaches are a recurring route.
For customers. Use app-based or hardware authentication rather than SMS codes where possible. Treat urgent requests for money or one-time codes as suspect, even if the voice sounds right. Verify through a number you already trust. Be alert to phishing that uses details from earlier breaches.
If you build or run financial software and want to review your exposure, our team works on this in fintech and compliance. See our services or get in touch.
Frequently Asked Questions
Are hackers really hitting banks in seven countries at once?
Serious incidents are being reported in several countries, but they are separate events with different causes, not one coordinated campaign. Some involve AI-assisted intrusions (South Korea, Latin America), some are social-engineering fraud (Italy), and some are older-style theft (crypto exchanges). Calling it one wave overstates what the evidence shows.
Did hackers use Claude to attack banks?
Security researchers at Straiker reportedly found a group using a network of AI agents, including Claude, Grok and Kimi, against more than 400 financial targets in Latin America. Coverage is secondhand and details differ between outlets. Anthropic reportedly revoked the credential the group used.
Was the Intesa Sanpaolo fraud an AI hack?
It was AI-assisted fraud, not a hack. Reports say criminals impersonated the CEO on WhatsApp and cloned a lawyer's voice to persuade Fideuram, Intesa's private bank, to send about €95 million in February 2026. The bank says no IT systems were breached, and roughly €53-59 million was reportedly recovered.
What can banks and customers do?
Banks need out-of-band verification for large transfers, strong identity checks on internal tools, and tested incident plans. Customers should use app-based or hardware authentication, treat urgent requests for money or codes as suspect, and verify through a number they already trust.