Hacker with No IT Background Uses Generative AI to Breach Companies, Steal 8.2 Million Records, Demand Money

Suspect in AI-assisted hacking of about 90 companies apprehended

Threatened, "Pay up or we'll leak the data"; seven arrested

An individual, not a professional group, used AI for large-scale hacking

A group that used generative artificial intelligence (AI) to hack into systems and leak more than 8.2 million pieces of personal information and internal documents was arrested after demanding 360 million won from victim companies and threatening them.

The arrest of Mr. A, the ringleader who used generative AI to carry out hacking. Seoul Metropolitan Police Agency

On Oct. 26, the Seoul Metropolitan Police Agency's Cyber Investigation Unit said it had arrested seven people, including A, 32, on suspicion of violating the Act on Promotion of Information and Communications Network Utilization and Information Protection and of extortion and attempted extortion. For 13 months from September 2025 through recently, the group used generative AI and other tools to break into the systems of about 90 companies, steal 8.2 million pieces of personal information and demand money from the victims. The victims included not only small and medium-sized businesses such as academies, hospitals, golf courses and funeral service companies, but also affiliates of large corporations.

On Oct. 23, police referred A, the ringleader who directly carried out the hacks, to prosecutors in custody on suspicion of stealing about 900,000 pieces of personal information from 15 companies that had reported the incidents. Police plan to investigate additional allegations involving 75 other victim companies that have not yet filed reports before referring the case to prosecutors. The remaining six accomplices are being investigated without detention.

The investigation began in June after one victim company filed a complaint. As reports of similar attacks came in from across the country, the Seoul Metropolitan Police Agency's Cyber Investigation Division took over the case in August and combined the investigations.

Police apprehended five accomplices who threatened employees of the victim companies by phone and text message, as well as accomplice B, 24, who had incited them to commit the crimes.

This month, police analyzed and traced log data and related evidence from the victim companies, leading to A's arrest. A search of A's residence in Yeoksam-dong, Seoul, yielded key evidence, including the computer and hacking tools used in the attacks and accounts used to make threats.

So far, the group is believed to have threatened 38 companies and demanded a total of 360 million won. However, the amount actually paid to the group was just 300,000 won.

An example of a text message threatening to extort money after stealing personal information from a company. National Police Agency

According to police, A had no formal background in IT and learned hacking techniques on his own through blogs, YouTube and other sources. From 2019 to 2022, he worked in penetration testing at a cybersecurity company. In the early stages of the crimes, he manually operated automated tools that identify website vulnerabilities to carry out hacks. Starting in August, he used generative AI to launch fast and wide-ranging cyberattacks against one company a day.

Police also confirmed that the attacks used an "AI autonomous penetration testing system" that had recently been used to steal personal information from financial institutions.

A scene from the search of ringleader Mr. A's residence. National Police Agency

The case demonstrated that, with help from AI, even an individual—not just a professional hacking group—can carry out large-scale attacks against numerous companies.

The National Office of Investigation and the Seoul Metropolitan Police Agency had been discussing response measures in anticipation of an increase in hacking crimes involving the misuse of AI. The National Office of Investigation provided the Seoul agency with high-performance AI computers, and the Seoul agency developed three AI analysis tools using an internal-network generative AI analysis system that prevents investigative materials from being transmitted externally. The tools were used in this case.

Oh Gyusik, head of the Seoul Metropolitan Police Agency's Cybercrime Investigation Unit 2, said, "The effectiveness of the AI analysis tools has been confirmed, including by reducing the number of investigators needed and shortening the investigation period to four months."

He added, "This is the first case in South Korea in which a suspect was apprehended in connection with large-scale hacking and personal information theft involving the misuse of generative AI. We will expand the use of AI in investigations and actively respond to increasingly sophisticated cybercrime."

This content was produced with the assistance of AI translation services.