Article By Frank Bergman
Bank customers could face sudden service shutdowns lasting several weeks as financial institutions brace for an accelerating wave of AI-driven cyberattacks.
Osamu Terai, a managing executive officer at Mizuho Financial Group and chairman of a Japanese public-private financial cybersecurity working group, warned that banks may increasingly need to shut down services deliberately to prevent a catastrophic breach.
The shift marks a stark break from the long-held banking promise that systems must never stop.
Terai likened the emerging strategy to a planned railway suspension before a typhoon.
Rather than allowing a known vulnerability to remain open until hackers exploit it, banks may decide to shut services down, patch systems, investigate for intrusions, and restore operations only when it is safe.
The disruption may not be brief.
According to Terai, a shutdown “could potentially last two to three weeks or even a month.”
AI Is Giving Hackers Unprecedented Power
The warning comes as artificial intelligence gives cybercriminals the ability to attack targets around the clock, scan for weaknesses at scale, and exploit vulnerabilities that would once have required highly skilled hackers.
AI systems do not sleep, take breaks, or stop working overnight and on holidays.
That gives attackers a massive advantage against organizations with limited cybersecurity staff.
Terai warned that AI has increased both the “volume” of attacks and the number of criminals capable of launching sophisticated intrusions.
The result is a rapidly expanding threat environment in which hackers are no longer limited to targeting major corporations.
They can use AI to search for large numbers of organizations that hold valuable personal information but have weaker defenses.
One tool drawing growing attention is ARTEX, an open-source autonomous penetration-testing system developed in China.
ARTEX can connect to large language models and allow AI agents to scan systems, identify vulnerabilities, map potential entry points, and run security tools.
Although such systems can be used legitimately by companies to test their own defenses, they can also be weaponized by criminals.
Financial Institutions Already Targeted
In South Korea, attacks against financial institutions from late September through early October reportedly affected 16 institutions and exposed roughly 100,000 pieces of personal information.
Reports indicated that names and contact information were compromised, though no account or card numbers were confirmed as leaked.
In Japan, cybersecurity firm GMO Cybersecurity by Ierae reportedly found traces of ARTEX on six overseas servers used in attacks between September 18 and October 18.
Approximately 80 Japanese companies, including firms in finance, insurance, and logistics, were targeted, while confirmed information leaks occurred at eight companies.
However, investigators have cautioned that finding traces of ARTEX on attack infrastructure does not prove that the tool was used in every intrusion.
It has also not been confirmed that attacks in Japan and South Korea were carried out by the same group.
Core Banking Systems Are Not Untouchable
The systems that manage account balances, withdrawals, and transfers remain heavily protected.
But Terai warned that the risk of an attack reaching core banking systems “is not zero.”
Banks are connected to ATMs, mobile apps, internet banking, outside vendors, and physical branches.
Every customer transfer made from a smartphone relies on a chain of systems that ultimately connects back to the bank.
Hackers are more likely to target the weakest point first rather than attempting to break directly into the most heavily guarded system.
Those weak points can include outsourced servers, email-distribution services, inquiry forms, campaign websites, and other systems operating at the edge of a company’s network.
The threat has forced financial institutions to focus on network separation, layered defenses, and “zero trust” systems that verify every access request rather than assuming an internal network is safe.
🔴 Japan’s Nikkei: ‘Financial services may choose to shut down: A month-long halt is “possible” as a cyber defense measure.’ Nov. 9th, 2026.
— INTERCEPTOR (@InterceptorNews) November 9, 2026
Preventive Bank Shutdowns Already Began
The “dare to stop” approach is no longer theoretical.
In October, multiple Japanese financial institutions reportedly suspended services after a critical vulnerability was discovered in the widely used PHP programming language.
MUFG Bank temporarily suspended some internet-banking transactions.
Hokuyo Bank halted web-based card applications.
Hachijuni Bank, Nagano Bank, Fukuoka Bank, and Shizuoka Bank also suspended some online services.
No unauthorized-access damage was confirmed at those institutions, and no impact on interbank settlement systems was reported.
But the incidents demonstrated the new reality: Banks may choose to shut systems down before a cyberattack hits, even if customers receive little warning.
Unlike a planned railway suspension, notifying customers in advance could also alert hackers that a vulnerability has been discovered.
That means consumers may simply wake up one morning to find their banking app unavailable.
Long-Term Cyber Outages Have Already Crippled Major Companies
The financial sector is moving toward preventive shutdowns because the alternative can be far worse.
After a ransomware attack in 2023, the Port of Nagoya’s container-terminal system suffered major disruption for roughly three days.
Japanese media company KADOKAWA suffered a cyberattack in June 2024 that shut down services, including “Niconico,” for approximately two months.
The company recorded an extraordinary loss of roughly $24 million.
In 2025, Jaguar Land Rover halted production for approximately five to six weeks after a cyberattack.
The automaker recorded roughly $264 million in cyber-related costs for the quarter, while the U.K. Cyber Monitoring Centre estimated the wider impact on Britain’s economy at approximately $2.6 billion.
Asahi Group Holdings suffered a ransomware attack in September 2025 that crippled its order and shipping systems.
System-based ordering and shipping at Asahi Breweries and Asahi Soft Drinks did not resume until December 3.
Online retailer ASKUL was also hit by ransomware in October 2025, forcing it to suspend orders across several services.
Its LOHACO platform did not fully resume taking orders until mid-January 2026, roughly three months later.
Prepare for Sudden Banking Disruptions
Terai urged customers to avoid placing all of their financial access in a single online bank.
While ATMs, online banking, and physical branches often operate independently, online-only banks offer few alternatives if their digital services are suspended.
Customers should consider maintaining accounts at multiple banks, including at least one institution with physical branches.
They should also keep some cash available, understand which bills are tied to each account, and ensure they can access official bank communications without relying on a single mobile app.
Customers should also be alert for phishing scams during outages.
Criminals frequently exploit confusion by sending fraudulent messages claiming that an account must be verified or reactivated.
The era of banks that “never stop” may be ending.
Financial institutions are now preparing for a future in which a temporary shutdown is viewed as the safer option, before AI-powered cyberattacks inflict far greater damage.
Be the first to comment