-
Authorities in South Korea have apprehended a hacker who learned through practice, along with six companions, for exploiting AI technology to swipe 8.2 million records from 90 companies.
-
The hackers were demanding 360 million won from 38 victims; however, only one business responded and made a small payment of $210.
-
Authorities dubbed this incident the first case of massive hacking in South Korea through generative AI – stating that AI is making it easier for people to commit cybercrimes.
In South Korea, police have apprehended a self-trained hacker for using artificial intelligence tools to breach numerous companies. He formed a group of seven members that managed to obtain 8.2 million pieces of information from more than 90 organizations. The victims included hospitals, private education institutions, plus golf clubs.
The hacker, who is 32 years old, does not have any formal training in IT. He learned hacking by reading blogs and watching clips. He got a job at a security company where he conducted simulation exercises from 2019 to 2022. Police said the incident marks the first case of criminals using generative AI in South Korea.
How the AI-Powered Attacks Worked
The group’s campaign ran from September last year until this month. Early on, A used standard automated tools to find weak points on websites. Then he changed his method. From late August, he began using generative AI and an AI-powered autonomous penetration system.
That shift made a big difference. Police say he breached 60 companies in just over 40 days using AI. The tool he used included ARTEX, a Chinese-made AI system that also appeared in a recent breach of South Korean financial institutions. Although the police did not establish a link between the two crimes, they found the use of the same tool in both incidents.
Names, registration numbers, phone numbers, and addresses are part of the stolen information. Employee details and internal business documents were also taken. Police said payment data like credit card numbers was not leaked. They also said they found no evidence regarding the sale of the data on the dark web.
The scale of the operation stands out. Hackers who attacked 60 companies in six weeks would require a skilled, well-trained crew to do that. Police claim only one hacker did it with the help of AI. The automated system handled the repetitive parts, such as scanning sites and testing for weak spots. This let the suspect move much faster than a manual attacker could.
The Extortion Attempt and Its Failure
After stealing the data, the group sent threatening emails to the victim companies. The messages warned that a public leak would damage the company’s image and lead to fines and lawsuits. Once some firms neglected their warnings, the group intensified their actions. The accomplices of the group contacted senior management and employees of companies to terrorize and pressure them to comply.
The total demanded amount from 38 firms was 360 million won, which is approximately $272,000. But the scheme did not bring much success. Only one small firm from the list sent the money – they forwarded 300,000 won, which equals approximately $210.
According to the police, the accomplices utilized ads on Telegram. The ads stated that those who wanted to become involved will do ‘simple phone work’ and receive 10,000-30,000 won for each call. The recruits are of the age range of 20 to 50 years.
The low payout shows how badly the extortion worked. Most companies refused to pay. Some reported the threats to police instead. That response helped investigators trace the group.
What this Case Means for AI and Cybercrime
Police described this case as a warning sign. They said it shows that AI is lowering the barrier to large-scale cybercrime. A single person with basic knowledge can now attack many companies in a short time. A police official said even individuals who are not professional hacker groups can now carry out large-scale hacking with the help of an AI.
The investigation began in June after one victim company filed a complaint. As more reports came in from across the country, police consolidated the cases in Seoul in August. They arrested five accomplices between July and September. They caught the sixth in early October. Then they tracked down A and arrested him on October 15.
Police also used their own AI tools in the investigation. They developed an in-house AI analysis system to process about 530,000 call and account records. This helped them identify the ringleader. The force said it will keep using AI to fight AI-driven crime. South Korean authorities are also developing advanced technology to identify and track drug dealers operating on the dark web.
Authorities are still investigating. Only 15 companies have formally reported damage so far. The police are optimistic that they will discover more victims, as there are still about 75 companies that have not reported any attacks. Investigators are currently looking into whether any of the stolen information is already on the internet.
In light of the incidents, there are calls for increased scrutiny. Experts in security believe that businesses should check their systems for vulnerability attacks via AI tools. Frequent monitoring and patching of systems enable companies to detect automated attacks – also, rapid reporting to police also improves the chance of catching the attackers early.
