Seoul police have arrested seven people over a hacking campaign that allegedly used generative artificial intelligence to penetrate about 90 organizations and obtain 8.2 million records, in what authorities describe as South Korea’s first major case involving arrests linked to large-scale AI-assisted hacking.
The targets reportedly included hospitals, universities, private cram schools, golf courses and subsidiaries of major conglomerates. The stolen information included names, contact details and other records belonging to ordinary people. Police said one funeral-services company lost 1.22 million records, while data taken from some academies reportedly included information about minors.
According to Decrypt, the alleged leader is a 32-year-old man who did not have a formal information-technology background. He reportedly told investigators that he learned hacking through YouTube and online blogs. Police also said he had carried out simulated attacks while working at a security company between 2019 and 2022.
The campaign is believed to have operated for roughly 13 months, from September 2025 through October 2026. The case began in June after one victim complained to police, and 15 organizations have reported damage so far. Authorities said they are continuing to investigate the six alleged accomplices and search for additional victims.
How the alleged operation worked
The alleged ringleader initially relied on website vulnerability scanners, which search online services for weaknesses that could be exploited. In late August, police said, he added an AI coding agent capable of writing and executing code, along with an autonomous penetration-testing system known locally as Artex.
Penetration testing is normally used by organizations or security professionals to imitate attacks and identify vulnerabilities before criminals can exploit them. In this case, investigators say the same type of automated capability was used offensively.
Police allege that the suspect breached 60 companies in 44 days, between August 31 and October 13. Authorities said an operation on this scale would previously have required a group of hackers, while AI tools allowed one person to automate more of the work and move faster.
The suspects allegedly attempted to turn the stolen information into money. Emails sent to 38 victims demanded a combined 360 million won, equivalent to about $272,000. Police have confirmed only one payment: 300,000 won, or approximately $210.
The alleged leader was sent to prosecutors in custody on Friday. He faces charges under South Korea’s information and communications network law, as well as extortion and attempted extortion charges. The other six suspects remain under investigation, according to police.
A broader test of AI’s role in cybercrime
The arrests come as the use of generative AI in criminal activity receives growing attention. In 2023, WormGPT, an AI chatbot developed without the safety restrictions used by mainstream services, was reportedly used to produce convincing phishing emails designed to trick recipients into revealing passwords or sending money.
Anthropic said in August 2025 that one criminal used its Claude Code tool in an extortion campaign involving at least 17 organizations. The reported ransom demands ranged from $75,000 to $500,000 in Bitcoin. In November, the company said a Chinese state-sponsored group used Claude to conduct 80% to 90% of an espionage campaign against about 30 targets, although only a small number of the attempted intrusions succeeded.
The evidence does not point to a single, settled conclusion about how much AI has changed hacking. A recent study by researchers at the universities of Cambridge, Edinburgh and Strathclyde examined 97,895 cybercrime forum threads. It found that AI’s clearest effects so far appeared in activities that were already highly automated, including search-engine-optimization fraud, social-media bots and romance scams. The researchers found little indication that coding tools had enabled low-skilled criminals to go substantially beyond existing scripts.
The Seoul case nevertheless highlights the practical concern for organizations holding sensitive personal information: tools that can generate code, scan systems and automate parts of penetration testing may reduce the time and technical knowledge needed to conduct a large campaign. The investigation will determine how extensively those tools were used and whether more victims were affected.
Moneyiar market picture
Moneyiar data as of October 25, 2026, at 22:39 (+03:30) showed the following moves:
- Polygon (prev. MATIC), now listed as POL, was priced at $0.0898082186, up 0.39% over 24 hours but down 0.74% over seven days.
- Compound (COMP) stood at $21.1287447338, down 10.42% in 24 hours and up 0.30% over seven days.
- Ore (ORE) traded at $164.7502665491, rising 4.48% over 24 hours and 56.42% over seven days.
These market figures are provided by Moneyiar and are separate from the South Korean police investigation.
