Police say AI tools let one hacker break into 90 South Korean groups

South Korean police say a 32-year-old hacker used an AI toolkit to break into more than 90 organizations and steal 8.2 million records. The targets included schools, hospitals, large companies and even golf courses. Police identified seven suspects in total. They describe it as the first arrest in Korea tied to a large-scale hack that used generative AI.

What happened

Police say the group's leader started attacking organizations in September 2025 with conventional hacking tools. In late August 2026, he switched to AI tools to widen the attacks. The main tool was ARTEX AI, a penetration testing framework. Penetration testing means hiring experts to hack a system on purpose so its weaknesses can be fixed. Here, it was allegedly turned against real victims.

In 38 of the incidents, the hacker demanded 360 million won, about $270,000, and promised not to leak the stolen data if paid. The same framework was used in earlier attacks on several South Korean banks, which were attributed to a Chinese-speaking threat actor.

Who is involved

Local media citing the Seoul Metropolitan Police report that the leader worked at a cybersecurity company between 2019 and 2022 and has a background in penetration testing. Yonhap News describes him as a self-taught hacker. He was arrested on October 15, formally detained two days later and referred to prosecutors on October 23. The other six suspects are under investigation but have not been detained.

How police caught him

The case began when a victim filed a complaint in June. Investigators traced the suspects through server logs from the breached organizations. Police also reportedly used an in-house AI tool to analyze the evidence they recovered.

Why it matters

Police said AI has lowered the barrier to entry for aspiring cybercriminals. Attacks that once took skilled, knowledgeable hackers can now be carried out by far less experienced people. In their words, even individuals who are not professional hacker organizations can now hack on a large scale with the help of AI. For a small business, that means being small is no longer much protection.

What to do

• Use strong, unique passwords for every account.
• Turn on two-step login wherever it is offered.
• Keep backups of important data and store them safely.

What happens next

Police are still investigating. They are now checking whether any of the stolen data has been leaked on the dark web, a hidden part of the internet where stolen data is often traded. It is not yet clear how many of the victims paid.