South Korean police arrested 7 people in the first large-scale AI-assisted hacking case

Seoul police arrested 7 suspects accused of using generative AI to launch hacking attacks. The Seoul Metropolitan Police Agency stated that about 90 organizations were involved, collectively stealing 8.2 million records, marking the first large-scale arrest of suspects in AI-assisted hacking attacks in South Korea. The targeted victims included hospitals, universities, private tutoring centers, golf courses, and subsidiaries of large corporate groups, all of which held a significant amount of personal information, including names, contact details, and records of ordinary citizens. One funeral service company lost 1.22 million records, and reports indicated that the tutoring center's data also contained information on minors.

According to local media reports, the main suspect, 32 years old, studied arts and sports and has no IT background. He told investigators that he self-taught hacking techniques through YouTube and online blogs, while police pointed out that he had worked in a security company conducting simulated attacks from 2019 to 2022. He initially used website vulnerability scanning tools and later introduced AI coding proxies and an automated penetration testing system called Artex at the end of August. Police stated that he hacked into 60 companies over a span of 44 days from August 31 to October 13.

The entire attack operation lasted about 13 months, from September 2025 to this October, and the case was filed in June after a victim reported it. Police indicated that such a large-scale attack previously required a hacker group to accomplish, but AI now allows one person to achieve this in a short time. The suspect sent emails to 38 victims, collectively extorting 360 million Korean won, approximately 272,000 US dollars, but the only confirmed payment was 300,000 won, about 210 dollars. The main suspect was detained and transferred to prosecutors last Friday, facing charges of violating South Korea's Information and Communication Network Act, as well as extortion and attempted extortion. Police will continue to investigate the other 6 accomplices and confirm more victims, with 15 institutions already reporting damages.