South Korean police have arrested a former penetration tester suspected of orchestrating cyberattacks against more than 90 organizations, resulting in the theft of approximately 8.2 million personal data records. Investigators say the suspect increasingly relied on artificial intelligence tools to expand the operation and carry out attacks against a wide range of targets.
The alleged ringleader is a 32-year-old man who previously worked for a cybersecurity company between 2019 and 2022. According to the Seoul Metropolitan Police, he began targeting organizations in September 2025, initially using conventional hacking techniques before adopting AI-assisted tools in late August 2026.
Among the technologies reportedly used was ARTEX AI, an autonomous penetration testing framework designed to assist with security assessments. Although such tools have legitimate applications in identifying vulnerabilities, investigators believe the suspect exploited the technology to compromise systems without authorization.
The victims included educational institutions, hospitals, major companies, and golf courses. Police believe the attacks exposed millions of records, although the investigation is still determining whether the stolen information has been distributed or sold.
The operation also involved attempted extortion. In 38 cases, the suspect allegedly demanded ransom payments totaling 360 million South Korean won, approximately $270,000, in exchange for promises not to publish the stolen information.
The investigation began after an affected organization submitted a complaint in June 2026. Police subsequently examined server logs and other digital evidence to identify individuals believed to be involved in the attacks.
Seven suspects have now been arrested in connection with the operation. The alleged leader was arrested on October 15, formally detained two days later, and referred to prosecutors on October 23. The remaining six suspects are being investigated without detention.
Investigators also reportedly used an internally developed AI tool to analyze evidence collected during the case. This reflects the growing role of artificial intelligence in both cybercrime investigations and the attacks themselves.
South Korean authorities described the case as the country’s first arrest involving large-scale hacking and personal information theft allegedly facilitated by generative AI. Police warned that automated tools could enable individuals without the resources of established cybercriminal organizations to conduct extensive attacks.
ARTEX AI has also been associated with separate cyberattacks against South Korean banks, reportedly involving a Chinese-speaking threat actor. However, authorities have not established a connection between those incidents and the suspects in the latest case.