South Korea Arrests Seven in First Big AI-Assisted Hacking Case
In brief
- Seoul police arrested seven people over a campaign that used generative AI to hack about 90 organizations and steal 8.2 million records, which police call South Korea’s first large-scale AI-assisted hacking arrests.
- The alleged ringleader, 32, taught himself hacking and added an AI coding agent and an autonomous penetration-testing tool in late August; police say he breached 60 companies in 44 days.
- Emails to 38 victims demanded a combined 360 million won, about $272,000, but the only confirmed payment was 300,000 won, about $210.
Police in Seoul have arrested seven people in a hacking campaign that used generative AI to break into about 90 organizations and steal 8.2 million records.
The Seoul Metropolitan Police Agency announced the case Monday and called it the first time in South Korea that suspects in a large-scale AI-assisted hacking operation have been apprehended.
The targets included hospitals, universities, private cram schools, golf courses and subsidiaries of large conglomerates, according to police—places that hold the names, contact details and records of ordinary people. One funeral services provider lost 1.22 million records, and one report said data from the academies included information on minors.
The alleged ringleader is a 32-year-old who studied arts and physical education and has no IT background, per local reports. He told investigators he taught himself hacking through YouTube and online blogs, though police say he also did simulated attack work at a security company from 2019 to 2022.
He started with website vulnerability scanners, software that probes a site for weak spots. In late August, reports say, he added an AI coding agent—a program that writes and runs code on its own—and an autonomous penetration-testing system, a tool that automates the mock break-ins companies normally hire experts to run. Police say he then breached 60 companies in 44 days, from August 31 to October 13.
→Police said an attack of this size once required a hacking group, and that AI now lets one person pull it off in a short time. Local reports name the autonomous tool as Artex. The campaign ran about 13 months, from September 2025 through this October, and the case opened in June after one victim filed a complaint.
Criminal use of AI has been building for years, mostly in reports from AI companies rather than police. WormGPT, a ChatGPT clone built without safety guardrails, was used in 2023 to write convincing phishing emails—fake messages designed to trick people into handing over money or passwords.
In August 2025, Anthropic said a single criminal used its Claude Code tool to run a vibe hacking extortion campaign against at least 17 organizations, with ransom demands from $75,000 to $500,000 in Bitcoin. In November, the company said a Chinese state-sponsored group used Claude to carry out 80% to 90% of an espionage campaign against about 30 targets, though only a small number of the intrusions succeeded.
Researchers at Cambridge, Edinburgh, and Strathclyde universities pushed back on the hype in a recent study of 97,895 cybercrime forum threads. They found AI’s main impact so far in already-automated areas such as SEO fraud, social media bots and romance scams, with little sign that coding tools helped low-skill actors beyond pre-made scripts.
The ringleader was referred to prosecutors in custody on Friday and faces charges under South Korea’s information and communications network law, plus extortion and attempted extortion. Police said they will keep investigating the six accomplices and try to identify additional victims, and 15 organizations have reported damage so far.
Related stories
NBA Embraces the CFTC on Prediction Markets as the NFL Fights It in Court
CZ pitches BNB Chain’s role in AI as BNB Standard rings Nasdaq bell
Tokenised US Stock Venues Must Give 30 Days’ Public Notice, SEC Clarifies
