The Seoul Metropolitan Police announced on Monday October 26 the arrest of seven people in South Korea. They are accused of hacking some 90 South Korean organizations and stealing 8.2 million personal data. The alleged ringleader is 32 years old and has a degree in arts and physical education. This hacker mainly had generative AI tools, which allowed him to chain 60 intrusions in 44 days.
This case falls three days after the global operation against AI-powered scams. South Korea is thus opening its first major legal case of AI-assisted hacking. The victims are hospitals and schools. However, the loot, made up of names, telephone numbers and internal files, fuels phishing which also targets holders of cryptocurrencies.
The main suspect never studied computer science. Police describe him as a self-taught man trained on blogs and YouTube videos. However, he worked from 2019 to 2022 in a security company. He carried out intrusion tests for clients there. In other words, he was a pentester, paid to break into systems with the consent of their owner.
Its attacks begin in September 2025 with classic vulnerability scanners. This software identifies known flaws in a website. Then, at the end of August 2026, the hacker adds an AI programming agent and an autonomous penetration testing system. Korean media calls it Artex. Therefore, sixty organizations fall between August 31 and October 13. More than one a day.
In total, police count around 90 targets in South Korea. There are hospitals, universities, golf courses and subsidiaries of large conglomerates. Added to this are hagwons, these private tutoring schools. One funeral service provider alone lost 1.22 million files. Furthermore, school data concerned minors, according to the local press.
“AI now allows a single person to achieve this in a short time,” summarizes the Seoul police in comments reported by Decrypt. For its part, the Korea Times, relay of the Yonhap dispatch, talks about the first South Korean file of this type.
The group sent threatening emails to 38 organizations. He demanded 360 million won in total, or about $272,000, not to publish the data. To put pressure on, an accomplice recruited little hands on Telegram. The advert was worthy of a student job: “Looking for people to make simple paid phone calls. Thirty seconds is enough. » The recruits called and then texted employees of the targeted organizations.
The financial results, however, are derisory. According to Decrypt, the only confirmed payment was 300,000 won, approximately $210. However, none of the sources consulted specify the requested means of payment. It is therefore unknown whether cryptocurrencies were at stake.
The investigation began in June following a complaint from a victim. The police first retrieved the logs from the compromised servers. They also used their own AI analysis system to sort through the evidence. Six accomplices were arrested between July and September, then the ringleader on October 15.
Placed in detention two days later, he was referred to the public prosecutor's office on October 23. He is being prosecuted for violating the law on information networks and for extortion, including attempted extortion. Finally, the police claim to have recovered all of the stolen files. However, she checks whether copies are circulating on the dark web. Fifteen organizations have reported damage at this point.
You don't own a golf course in Seoul and you feel safe. Error. A single hacker and two AI tools were enough to accumulate 8.2 million records in thirteen months. The same day, the Washington Post reported how the AI agents of the startup Cathedral had found a path to Anthropic's internal systems. It took them less than twelve hours.
For crypto, the reasoning takes two steps. First, the stolen files are used to create tailor-made emails and calls. They contain a name, telephone number, email and sometimes medical or school records. However, a fake exchange advisor who knows your name comes across much better than a generic message. Then, the same generative tools write these messages in succession, in impeccable French.
Exchange platforms already have safeguards: strong authentication, withdrawal delay after a change of address, whitelist, connection alerts. On the other hand, users of non-custodial wallets have no customer service to catch them up. A seed phrase entered on a fake site is a lost seed phrase.
