Hacker Uses AI to Breach 90 South Korean Organizations and Steal 8.2 Million Records

South Korean police have arrested a 32-year-old man accused of leading an AI-assisted hacking operation that stole personal records and internal files from about 90 organizations, totaling 8.2 million records.

Targets included hospitals, private academies, golf courses, universities, and large companies’ affiliates. Investigators said the group used stolen data to pressure victims into paying money.

The Seoul Metropolitan Police Agency announced the case on October 26. The alleged ringleader, identified as “A,” was arrested on October 15 and referred to prosecutors on October 23 while in custody.

Six other suspects remain under investigation and are not in custody, according to reporting on the police findings. Police said the attacks began in September 2025 and continued into October 2026. Although the suspect did not study information technology, he taught himself hacking through online material.

He worked in penetration testing at a security company between 2019 and 2022. That background gave him practical experience before the alleged criminal campaign.

The suspect initially used conventional hacking tools to identify website weaknesses. Investigators said he began using generative AI more widely in late August 2026, expanding the operation.

Around 60 of the targeted organizations were reportedly breached with help from AI tools, rather than every intrusion involving AI from the outset.

AI Hacker Breaches South Korean Organizations

Reporting identified the software as ARTEX, an AI penetration testing framework also linked to separate attacks against South Korean financial institutions.

Cybersecurity News previously covered how hackers targeting South Korean banks exposed their attack tools, providing context about the framework and its use.

However, the shared tool does not establish that the same people carried out both campaigns. Public reporting also does not provide a complete attack chain for these 90 breaches.

The reports reviewed disclose no confirmed vulnerability list, malware details, or evidence that AI independently completed every intrusion.

After stealing information, the group allegedly sent threatening messages to affected organizations. The suspects warned that public disclosure could damage company reputations and lead to government fines.

Police identified 38 organizations connected to the extortion attempts, with combined demands reaching 360 million won, according to Yonhap News Agency.

That figure represents money demanded, not a confirmed total paid. The reported scheme focused on threatening to release stolen information. Available accounts do not describe a ransomware deployment or establish that the attackers encrypted victims’ systems.

The investigation followed a victim complaint in June. Police traced activity through affected organizations’ server logs and used an internal AI analysis system to examine evidence. Investigators recovered stolen information and continued checking whether copies had reached the dark web or supported further crimes.

Authorities described the arrests as South Korea’s first large-scale generative AI hacking case of this kind. The suspect’s prior testing experience remains important when assessing that claim. The case shows an experienced operator adopting AI, not proof that an untrained user could reproduce the same results.

The arrests follow wider concern about breaches in South Korea’s financial sector and security checks. Across both stories, investigators are examining AI’s role while key technical details remain undisclosed. For readers, separating confirmed breaches from claims of fully autonomous hacking remains essential to understanding the threat accurately.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hacker Uses AI to Breach 90 South Korean Organizations and Steal 8.2 Million Records appeared first on Cyber Security News.