The Seoul Metropolitan Police announced on October 26 the arrest of a 32-year-old individual identified only as A, who carried out a series of intrusions targeting around 90 companies and institutions across South Korea and exfiltrated 8.2 million personal records along with internal documents.
Approximately 60 of the victims were compromised with the assistance of generative artificial intelligence. The tool, identified as the ARTEX framework, required only the name of the target and autonomously determined the optimal attack path. Investigators noted that this level of automation enabled a single individual to achieve the scale of operations previously requiring a team of specialists.
The suspect had no formal education in technology and acquired his intrusion skills through materials freely available on the internet. Between 2019 and 2022 he worked in penetration testing at a security company. Six additional suspects remain at large under investigation.
Targets included hospitals, exam preparation courses, golf courses, universities, and subsidiaries of major corporations. After the thefts, the group demanded ransom from 38 organizations totaling 360 million won in Tether, threatening to publish the data and expose victims to regulatory fines and reputational damage. Police confirmed that 300,000 won were actually received.
The intrusions occurred between September 2025 and October 2026, with widespread use of generative AI beginning in late August 2026. The investigation was initiated in June following a complaint from one affected company. Officers traced the suspect through server logs from victim organizations and arrested him on October 15.
He has been referred to the Prosecutor's Office in custody on charges of violating the Information and Communications Network Act as well as completed and attempted extortion. Police described the case as the first large-scale incident in the country involving generative AI, stated that part of the stolen material has been recovered, and are checking for possible copies on the dark web. The total number of affected organizations may increase as the investigation continues.
