Law enforcement in South Korea has arrested seven individuals connected to a coordinated hacking campaign that infiltrated more than 90 organizations across the country. The Seoul Metropolitan Police identified the ringleader as a former penetration tester who worked in the cybersecurity sector from 2019 through 2022.
The operation resulted in the theft of 8.2 million data records from educational institutions, medical facilities, major corporations, and recreational venues. In 38 separate incidents, the attackers demanded ransom of 360 million won (approximately $270,000) in exchange for promises not to disclose the stolen information.
The 32-year-old gang leader, described as self-taught, initiated the campaign in September 2025. Police determined that the group employed the ARTEX AI penetration testing suite in the majority of attacks—the same autonomous framework linked to previous breaches of multiple South Korean banks attributed to a Chinese-speaking threat actor.
The attacker initially relied on conventional hacking tools before transitioning to AI-based utilities in late August 2026 to scale the operation. The shift to automated frameworks appears to have significantly expanded the scope and frequency of successful compromises.
Investigation and arrests
All seven suspects have been apprehended, though only the leader remains in custody. He was arrested on October 15, formally detained two days later, and referred to prosecutors on October 23. The remaining six individuals are under investigation but have not been detained.
The investigation began after a victim filed a complaint in June. Police traced the suspects by analyzing server logs from the targeted organizations and employed an in-house AI tool to process the recovered evidence.
AI lowering barriers to entry
Authorities emphasized that the case highlights a concerning trend in cybercrime. According to the Seoul Metropolitan Police, "This is the first case of arrest of a suspect in Korea related to a large-scale hacking and personal information theft crime that exploited generative AI."
The police further noted that "Even individuals who are not professional hacker organizations can now hack on a large scale with the help of AI." Officials believe that AI tools have substantially reduced the technical expertise required to conduct sophisticated, widespread attacks that previously demanded significant skill and knowledge.
Investigators are continuing their work to determine whether any of the stolen data has surfaced on the dark web.