Seoul’s Metropolitan Police Agency said Monday it had arrested seven suspects behind what it called South Korea’s first large-scale personal-information breach carried out with generative AI hacking tools — a campaign that hit roughly 90 organizations and made off with 8.2 million records.
How the generative AI hacking campaign worked
- Window: September 2025 to October 2026. Victims: hospitals, private academies, golf courses and a conglomerate affiliate, among about 90 firms.
- AI tools were used against 60 of the roughly 90 targets — at times, roughly one company a day, via an ‘AI autonomous penetration-testing system.’
- Ringleader ‘A,’ 32, had no formal IT background and taught himself hacking from blogs and YouTube; a 24-year-old lieutenant directed five others who phoned and texted employees with extortion threats.
- Demands: about 360 million won (roughly $260,000) across 38 companies. Collected: 300,000 won.
Police opened the case in June 2026 after one victim complained; the Seoul agency took over in August. Investigators turned the same technology on the suspects, using AI analysis tools to sift roughly 530,000 pieces of evidence. ‘A’ was referred to prosecutors in custody on Oct. 23, and 75 more affected companies had not yet filed reports.
The arithmetic is the story here: a self-taught hacker with no degree and a handful of accomplices industrialized data theft — and the extortion haul barely covered lunch for the crew. Law enforcement’s AI arms race just got a very public scoreboard.
Source: Decrypt, with arrests announced via Yonhap. More: AI & Agentic Finance.
