Seoul police have arrested seven people accused of using generative AI to break into more than 90 companies and steal 8.2 million pieces of personal data, the Seoul Metropolitan Police Agency announced on October 26. The ringleader, a 32-year-old with no information-technology degree, was detained and referred to prosecutors on October 23, while six accomplices are under investigation without detention. According to Yonhap, the group used AI tools to hack 60 of its targets, then threatened 38 companies and demanded 360 million won. Police say it is South Korea’s first large-scale arrest case involving generative AI in hacking and personal-data theft, and they have recovered the stolen data while tracing the criminal proceeds.
How The Ring Turned AI Into A Hacking Machine
According to the Seoul Metropolitan Police Agency, the group operated for about 13 months, from September 2025 to October 2026. Early on, the ringleader ran website vulnerability scanning tools directly. The pace changed sharply once he began making full use of generative AI: using an AI coding agent and an autonomous AI penetration testing system, he breached 60 companies in just over 40 days, from August 31 to October 13.
The ringleader, identified only as A, majored in arts and physical education and has no information-technology background. Police say he taught himself hacking by watching YouTube videos and reading blogs, though he had also worked on simulated hacking at a security firm from 2019 to 2022. The case is a reminder that AI coding tools can also become an attack surface, as shown when coding agents were hijacked through malicious instruction files in the OpenCode console breach.
Once inside a company’s systems, the group stole personal data and internal documents, then emailed the victims demanding money. The messages warned companies about damage to their image, fines and customer lawsuits if the leak became public. When a company did not comply, accomplices called or texted its executives and staff to press them again. Police say the accomplices joined after seeing recruitment posts on Telegram offering “simple phone work”, and were paid 10,000 to 30,000 won per call. One accomplice, a 24-year-old identified as B, procured the accounts used in the crimes and recruited the others.
What Police Seized And What Happens Next
Police opened the investigation in June after a complaint from one victim company, and began a comprehensive investigation in August as similar cases mounted across the country. Five people involved in the threats were arrested one after another between July and September, B was detained early in October, and the ringleader was then identified and arrested. Officers seized a laptop, burner phones and a wireless router from the ringleader’s home and recovered the stolen personal data stored on them.
The group faces charges of violating the Information and Communications Network Act, extortion and attempted extortion. Police say the group actually collected 300,000 won, about $210, from one company, while the attempt to extort 360 million won in total failed. Fifteen companies have reported damage so far, and police plan to identify additional victims among the roughly 90 entities hit, including private academies, hospitals, golf courses, funeral service providers and universities. One funeral services provider alone lost 1.22 million records, and data stolen from private academies included personal information on minors. Extortion after a breach is a pattern businesses have faced elsewhere this month, as when GMO Internet compensated customers after a cyberattack extortion threat.
Why It Matters
The case matters because it shows how far AI has lowered the skill barrier for large-scale cybercrime. Police said individuals without professional hacking backgrounds were able to breach large companies with AI’s help, and described AI as lowering the barriers to entry into cyberterrorism crimes. Oh Gyu-sik, head of the agency’s second cybercrime investigation unit, said “crime exploiting AI is evolving to a level that is difficult to counter with existing investigative methods alone”, and urged companies that are hacked to report it to police immediately rather than pay.
The arrests also land as AI systems are increasingly found acting without human approval, from Claude’s unauthorised access to Georgia voter data to agents that escape their test environments. In this case the autonomy was deliberate: an AI system did the breaking in, at a speed and scale the ringleader could not have reached alone. Police used AI on their own side too, analysing about 530,000 pieces of investigative material, including call and account records, to identify the suspects in about four months.
Background
South Korean authorities have recently been on alert over cybercrime suspected of using AI tools, including a series of high-profile attacks on financial institutions, and police note that the autonomous penetration testing system used in this case also appeared in a recent financial-sector data breach, though no connection between the two cases has been confirmed so far.
Source: Maeil Business Newspaper: Seoul AI hacking arrests; Yonhap: Yonhap AI hacking report
0 Comments