South Korea: ex-security expert allegedly hacked 90 organizations with AI's help

The alleged leader is 32. He did not study computer science: he taught himself hacking from blogs and YouTube videos, according to the Korea JoongAng Daily, then practiced it legally by simulating attacks for a cybersecurity company. According to BleepingComputer, citing local media, he worked there from 2019 to 2022. On October 26, the Seoul Metropolitan Police presented him as the head of a seven-person group that allegedly hacked about 90 South Korean organizations and stole 8.2 million personal records and internal documents.

Hospitals, golf courses, universities, tutoring academies, subsidiaries of major conglomerates: the victims were varied. The intrusions spanned September 2025 to October 2026. The group sent threatening emails to 38 victims, demanding a total of 360 million won (about $272,000) in exchange for a promise not to publish the data. “If you don't pay, we will disclose the information,” read one of these messages, quoted by the JoongAng Daily. It is unknown whether any ransoms were paid.

AI changed the scale of the operation

The group first used conventional tools. From August 2026, its leader began to rely heavily on generative AI, which significantly broadened the operation, according to police. Of the roughly 90 targets, 60 were allegedly hacked with the help of AI, the Korea Times reports. Police see this as the first arrest in Korea linked to large-scale AI-assisted hacking. They stress that individuals who do not belong to professional hacking groups can now attack at scale.

Which tool did they use? BleepingComputer, citing the Yonhap news agency, names ARTEX AI, an autonomous penetration-testing tool, which was allegedly used in most of the attacks. The Korean newspapers we consulted name no tool. ARTEX had already appeared in the attacks on South Korean banks described by CrowdStrike, but BleepingComputer attributes those to a different, Chinese-speaking actor.

How investigators tracked them down

The investigation began in June, after a complaint from a victim. Investigators traced the suspects through the server logs of the hacked organizations, BleepingComputer reports. Six accomplices were arrested between July and September, and the investigation into them continues. One of them recruited paid volunteers on Telegram to call and text the victims' employees to push them to pay. The leader was arrested on October 15 and referred to prosecutors on October 23, in detention. Police say they have recovered all the stolen personal data. They themselves analyzed the evidence with an in-house AI tool.

What this means for businesses

A former security professional, accessible tools and an AI to go faster: the threat does not change in nature, but in pace. For an SME or a healthcare facility, three habits follow.

• Patch internet-exposed services quickly: finding them takes attackers less and less effort.
• Keep your server logs long enough and out of an intruder's reach: in this case, they are what led to the suspects.
• Prepare teams for pressure calls: any call announcing a leak and demanding payment must immediately be escalated to management and the security team.

Police are continuing their search for accomplices and possible other victims. They are also checking whether any stolen data has been published on the dark web.