Seoul Police Arrest Seven in Landmark AI-Assisted Hacking Campaign Targeting 90 Organizations

SEOUL — In what law enforcement authorities are calling a watershed moment for cybercrime in the country, police in Seoul have arrested seven people in connection with a sprawling hacking campaign that leveraged generative artificial intelligence to breach approximately 90 organizations and steal 8.2 million sensitive records.

The Seoul Metropolitan Police Agency announced the breakthrough on Monday, emphasizing that this is the first time suspects involved in a large-scale, AI-assisted hacking operation have been apprehended within South Korea. The sophisticated operation underscores a troubling evolution in cyber threats, where advanced automation tools enable single individuals or small groups to execute attacks that previously required the coordinated resources of entire criminal syndicates.

A Wide-Ranging Trail of Compromised Data

The targeted entities represented a diverse cross-section of South Korean society and commerce, including hospitals, universities, private cram schools, golf courses, and subsidiaries of major corporate conglomerates. These organizations collectively held vast troves of personally identifiable information, including names, contact details, and private records belonging to ordinary citizens.

Among the hardest-hit institutions was a single funeral services provider, which suffered the loss of 1.22 million records. Reports from local authorities also indicated that data compromised from private educational academies included sensitive information regarding minors, raising significant privacy and security concerns.

Investigators identified the alleged ringleader as a 32-year-old individual who studied arts and physical education and possessed no formal professional IT background. According to local reports, the suspect claimed to have self-taught his hacking capabilities by watching YouTube videos and reading online blogs. However, police records indicate that he also gained practical exposure through simulated attack work conducted at a security company between 2019 and 2022.

The Weaponization of Autonomous AI Tools

The suspect’s illicit campaign reportedly began with traditional website vulnerability scanners—software programs designed to probe internet-facing platforms for underlying security flaws. However, the scale and velocity of the operations changed dramatically in late August when the ringleader integrated advanced artificial intelligence capabilities into his workflow.

According to investigators, the suspect incorporated an AI coding agent, which is a specialized program capable of writing and executing software code autonomously, alongside an autonomous penetration-testing system. Penetration-testing tools are typically utilized by legitimate cybersecurity professionals to automate mock cyberattacks and evaluate corporate defenses. In the hands of the alleged attacker, however, these tools were weaponized to scale the frequency and depth of unauthorized intrusions.

Police revealed that the suspect managed to breach 60 separate companies in just 44 days, operating continuously between August 31 and October 13. Law enforcement officials noted that an offensive campaign of this magnitude historically required a coordinated cybercriminal group, illustrating how generative AI tools have compressed the timeline and manpower needed to execute large-scale data breaches.

Local media reports identified the autonomous penetration-testing tool utilized in the campaign as Artex. The entire multi-pronged criminal enterprise spanned approximately 13 months, running from September 2025 through October of this year. The police investigation was formally initiated in June after an initial victimized organization filed an official complaint.

The Broader Context of AI-Driven Cybercrime

While this case marks a legal milestone for South Korean law enforcement, the broader intersection of generative artificial intelligence and cybercrime has been a growing concern for global security researchers for several years. Until recently, concrete insights into AI-driven threats primarily emerged from reports published by AI development companies rather than traditional police investigations.

In 2023, security analysts tracked the emergence of WormGPT, a specialized large language model engineered without ethical guardrails or safety filters, which malicious actors used to generate convincing phishing emails designed to trick targets into surrendering financial credentials and passwords.

The threat landscape shifted further in August 2025, when AI firm Anthropic reported that a single criminal had weaponized its Claude Code tool to execute a "vibe hacking" extortion campaign targeting at least 17 organizations. Those attacks involved ransom demands ranging from $75,000 to $500,000 payable in Bitcoin. Months later, in November, Anthropic reported that a Chinese state-sponsored threat actor utilized the same AI system to orchestrate between 80% and 90% of a massive espionage campaign targeting approximately 30 organizations, though only a fraction of those intrusion attempts ultimately succeeded.

Despite these high-profile incidents, cybersecurity researchers from Cambridge, Edinburgh, and Strathclyde universities recently published a comprehensive study analyzing nearly 100,000 cybercrime forum threads to assess the real-world impact of AI tools. Their findings suggested that AI’s primary utility for cybercriminals remains concentrated in domains that were already heavily automated, such as search engine optimization fraud, social media botnets, and romance scams. The researchers found limited evidence that advanced coding tools had drastically lowered the barrier to entry for low-skilled actors beyond assisting with basic, pre-made scripts.

Legal Fallout and Ongoing Investigation

The alleged mastermind behind the South Korean hacking campaign was referred to prosecutors while remaining in custody. He faces multiple serious criminal charges under South Korea’s information and communications network law, in addition to counts of extortion and attempted extortion.

Seoul police stated that their investigation into the six alleged accomplices remains active as authorities work to identify further victims and calculate the total scope of the breach. Thus far, 15 organizations have formally reported suffering damage from the campaign.