Seoul police arrest seven over AI-driven hacking spree that stole 8.2 million records

Seoul police have arrested seven people accused of using generative artificial intelligence to break into the systems of about 90 companies and steal 8.2 million pieces of personal information, in what police say is South Korea’s first case of suspects being caught for large-scale hacking and data theft involving the misuse of generative AI.

The Seoul Metropolitan Police Agency’s cyber investigation division announced the arrests on Monday, 26 October. The ringleader, a 32-year-old identified only as A, was detained and referred to prosecutors on charges of violating the Information and Communications Network Act, extortion and attempted extortion. The other six suspects are under investigation without detention.

Police say the group operated for about 13 months, from September 2025 to October 2026, breaking into company systems and stealing personal data and internal corporate documents, then threatening the victims with exposure unless they paid. The group threatened 38 companies and demanded about 360 million won (about $250,000) in total, but actually received only 300,000 won (about $210) from one company, police said.

The victims ranged from small and medium-sized businesses — including private academies, hospitals, golf courses and funeral services — to an affiliate of a large conglomerate and a regional mutual finance institution. One funeral services provider had 1.22 million records taken, and data stolen from private academies included personal information on minors.

A, who has no formal background in information technology, told investigators he taught himself hacking through blogs and YouTube videos. He had worked at a security company from 2019 to 2022 conducting simulated hacking and penetration tests. Police say he initially operated website vulnerability-scanning tools manually, but from August 2026 began using generative AI, including an AI coding agent and an autonomous AI penetration-testing system, breaching 60 companies in just over 40 days between 31 August and 13 October.

Police said the autonomous AI penetration-testing system used in the crimes was the same tool used in a recent personal data breach in the financial sector, but stressed that no connection between the two cases has been confirmed so far.

The investigation began in June 2026 after one victim company filed a complaint, and was consolidated by Seoul police in August as similar reports arrived from across the country. Five accomplices who threatened company staff by phone and text message were arrested between July and September, and a second suspect, B, aged 24, who procured accounts and recruited accomplices, was detained early in October. A search of A’s home in Yeoksam-dong, Seoul, recovered computers, hacking tools and the stolen data.

Police also used an in-house AI analysis tool in the investigation, analysing about 530,000 pieces of material including call and account records, which they said let a single team arrest seven suspects in about four months.

Oh Gyu-sik, head of the Seoul Metropolitan Police Agency’s second cybercrime investigation unit, said: “Crime exploiting AI is evolving to a level that is difficult to counter with existing investigative methods alone,” and urged companies not to pay if hacked but to report it to police immediately.

Sources

• The Asia Business Daily — “Hacker with No IT Background Uses Generative AI to Breach Companies, Steal 8.2 Million Records, Demand Money”: https://www.asiae.co.kr/en/article/incidents-accidents/2026102611180974952
• Maeil Business Newspaper — “Police arrest first suspect in AI hacking”: https://www.mk.co.kr/en/society/12185517
• Seoul Economic Daily — “Self-Taught Hacker Used AI to Steal 8.2 Million Records, Police Say”: https://en.sedaily.com/society/2026/10/26/self-taught-hacker-used-ai-to-steal-82-million-records