587/69 Wednesday, October 28, 2026
Police in Seoul, South Korea, have announced the arrest of seven suspects linked to a cybercrime operation that attacked more than 90 organizations in the country and stole approximately 8.2 million data records. Targets included educational institutions, hospitals, large companies, and golf courses. The suspected ringleader is a 32-year-old man with penetration testing experience who previously worked at a cybersecurity company between 2019 and 2022. He allegedly began carrying out attacks in September 2025 and reportedly used ARTEX AI, an AI-powered penetration testing framework, to support several attacks. The suspect was also accused of attempting to extort 38 affected organizations for a combined total of approximately KRW 360 million, or USD 270,000, in exchange for not publishing the stolen data.
Investigators found that the suspect initially relied on conventional hacking tools before beginning to use AI-based tools in late August 2026 to increase the scale and capability of the attacks. One of the main tools was ARTEX AI, an automated penetration testing framework that had previously been reported in attacks against several South Korean banks and linked to threat actors using the Chinese language. However, there is currently no confirmed evidence directly linking the two sets of incidents. Police stated that AI helped reduce the level of technical skill and expertise required to conduct attacks, enabling individuals who were not part of professional hacking organizations to carry out large-scale intrusions with significant impact.
Police began investigating after receiving a complaint from a victim organization in June 2026. Investigators later tracked the suspects using server logs from compromised organizations and used internally developed AI tools to assist with digital forensic analysis. All seven suspects have been arrested, although only the alleged ringleader remains in custody. He was arrested on October 15, formally detained on October 17, and referred to prosecutors on October 23. The other six suspects remain under investigation without detention. South Korean police stated that this is the country’s first case involving the arrest of suspects accused of using generative AI in a large-scale cyberattack and personal data theft operation. Authorities are also investigating whether the stolen information has already been published on the dark web.