Police say the tools did the work a specialist used to do
The Seoul Metropolitan Police Agency’s cyber investigation division said on 26 October that it had detained a 32-year-old man, identified only as “A”, and referred him to prosecutors over a hacking campaign against more than 90 South Korean businesses. Police describe it as the country’s first large-scale hacking case in which suspects using generative AI have been arrested.
The group stole about 8.2 million pieces of personal data between September last year and this month, according to police. Victims included an affiliate of a large conglomerate, private academies, hospitals, golf courses and universities. A funeral services provider alone lost 1.22 million records, and the academy data covered minors.
Forty days, sixty companies
Police said A began by running website vulnerability scanners himself. He later switched to an AI coding agent and an autonomous AI penetration testing system, and with those he breached 60 companies between 31 August and 13 October — just over 40 days.
A studied arts and physical education and holds no IT qualification; he told police he taught himself hacking from YouTube and blogs. Police believe he nonetheless had substantial web knowledge, noting that he worked on simulated hacking at a security firm from 2019 to 2022.
The extortion mostly failed
The group threatened victims with reputational damage and administrative fines if the leaks became public, and sought 360 million won in total, police said. One company paid 300,000 won — roughly $210. Fifteen companies have reported damage so far, and police said they will pursue further charges relating to victims that have not come forward.
Six accomplices are under investigation without detention. Police said recruits answered Telegram adverts offering “simple phone work” and were paid 10,000 to 30,000 won a call. A 24-year-old, identified as “B”, procured accounts and recruited others; the remaining suspects range in age from their twenties to their fifties.
Police built their own AI to run the case
The investigation ran the other way too. Police said they built an in-house AI tool to analyse about 530,000 investigative items, including call and account records, which let a single team arrest seven suspects in roughly four months. Officers opened the case in June after a victim’s complaint, began a comprehensive probe in August, arrested five people between July and September, detained B early this month, and then identified A.
Police said the autonomous penetration testing tool A used was the same one involved in a recent personal data breach in South Korea’s financial sector, but that they have not established a connection between the two cases.
Oh Gyu-sik, who heads the agency’s second cyber crime investigation unit, said crime exploiting AI is evolving to a level that existing investigative methods alone struggle to counter. A police official put it more bluntly: even people who are not professional hacking organisations can now carry out large-scale hacking with AI’s help. Police urged companies that are breached not to negotiate and to report immediately.
What to watch next is whether the financial-sector breach is formally linked to this case, and whether the victim companies that have not yet reported damage come forward.
