The Seoul Metropolitan Police Agency’s cyber investigation unit says it has arrested the suspected leader of a gang that breached more than 90 organizations in South Korea, including private academies, hospitals, universities, large-company affiliates and golf courses. Police estimate the group stole 8.2 million personal records and internal documents since September 2025 and then emailed victims demanding money in return for silence. According to Yonhap News, 38 organizations were sent demands totalling 360 million won (about $270,000, per BleepingComputer), with threats that a leak would damage their reputation and bring regulatory fines.
What makes the case notable is the tooling. Police say the 32-year-old suspect taught himself to hack from online blogs and worked in penetration testing at a security firm between 2019 and 2022. He first used conventional vulnerability-scanning tools, then moved to generative AI in late August 2026 to attack organizations on a much wider scale; police counted 60 victims hacked with AI. Yonhap says police found he also used an autonomous AI penetration-testing system recently used in financial-sector breaches, which BleepingComputer identifies as the ARTEX framework, the same tool linked to the attacks on South Korean banks. Police called it Korea’s first arrest over a large-scale hack and data theft that exploited generative AI, and said individuals outside professional hacking groups can now do this at scale. The earlier ARTEX coverage on this site covers Microsoft’s attribution of a separate operation (Storm-0940), and South Korea’s bank-breach probe covers the bank attacks.
The leader was arrested on October 15, detained two days later and referred to prosecutors on October 23. Yonhap reports that five accomplices who phoned and texted victims’ staff to pressure them were arrested one by one from July, and that six suspects are being investigated without detention. The case began with a victim’s complaint in June, and police traced the suspect through server logs from breached organizations. Police say they recovered the stolen data and are now checking whether any of it reached the dark web. These are police allegations; no court has ruled on the charges.