"This is the first case of arrest of a suspect in Korea related to a large-scale hacking and personal information theft crime that exploited generative AI," the Seoul Metropolitan Police told Yonhap.
Seoul Metropolitan Police investigation and arrests
South Korean police identified seven suspects connected to a cybercrime operation that breached more than 90 organizations across the country. Authorities opened the case after a victim filed a complaint in June and traced the suspects through server logs from the compromised entities. Law enforcement investigators also used an in-house AI tool to analyze recovered evidence during the probe.
All seven suspects have been arrested, but only the gang leader remains in custody. Arrested on October 15, he was formally detained two days later and referred to prosecutors on October 23. The remaining six suspects are under investigation without being detained.
The suspect’s background and timeline of activity
Local media, citing the Seoul Metropolitan Police, describe the gang leader as a self-taught 32‑year‑old who previously worked at a cybersecurity company between 2019 and 2022 and has a background in penetration testing. Yonhap News reports he began attacking organizations in September 2025.
Police say the actor initially used conventional hacking tools but began adopting AI utilities in late August 2026 to expand the scope of attacks. The shift in tooling is a central feature of the investigation and of police commentary on how generative AI has changed capabilities.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageARTEX AI pentesting suite used in most intrusions
Investigators told local media that the threat actor used the ARTEX AI penetration testing suite in most of the attacks. The police noted ARTEX AI is the same autonomous framework that was used in attacks against multiple South Korean banks that have been attributed to a Chinese‑speaking threat actor.
Police public statements framed the use of ARTEX and other AI utilities as lowering the barrier to entry for aspiring cybercriminals: "Even individuals who are not professional hacker organizations can now hack on a large scale with the help of AI," they told Yonhap.
Scope of theft, ransom demands, and victims
Authorities believe the group stole 8.2 million records from compromised organizations. Reported victims include educational institutes, hospitals, large corporations, and even golf courses. In 38 of the incidents, the threat actor demanded ransom payments of 360 million won (about $270,000), promising not to leak stolen data in exchange for payment.
Police said the investigation is continuing and is now focusing on whether any of the stolen data has been leaked on the dark web.
What this means for security teams, law enforcement, and the public
- Security teams and technologists: The police account highlights a tooling shift—from conventional methods to AI‑assisted frameworks—that expanded the attacks' reach. The report also notes that prevention effectiveness can fall sharply after attackers obtain valid credentials; the Blue Report 2026 is cited as measuring defenses technique by technique across 338 million simulations run in customer production environments.
- Law enforcement and investigators: Seoul investigators combined traditional log analysis with an in-house AI tool to trace suspects and analyze evidence, and they continue to pursue whether stolen data has been exposed online. The case establishes a procedural template for AI‑augmented forensic work, according to police statements.
- The public and affected organizations: The theft of 8.2 million records from a range of institutions underscores potential exposure of personal information across healthcare, education, corporate, and recreational sectors; authorities are explicitly investigating post‑theft data leakage.
The arrests represent a concrete law enforcement response to a pattern police say is driven by generative AI tools: ARTEX AI figured centrally in most intrusions, the suspect moved to AI tooling in late August 2026, and investigators needed both server logs and AI‑assisted analysis to build the case. With only the leader detained and questions remaining about whether stolen data has been published, the investigation is likely to determine not only culpability but also how quickly and widely the pilfered records surface online.
Source: BleepingComputer — Former pentester used ARTEX AI to steal 8.2 million data records