South Korean police arrest former penetration tester in 8.2 million record theft

South Korean police arrested a 32-year-old former penetration tester on Oct. 15, 2026, accusing him of stealing 8.2 million personal records from more than 90 organizations.

Six accomplices remain under investigation without custody. The Seoul Metropolitan Police formally detained the ringleader two days after the arrest and referred him to prosecutors on Oct. 23, 2026. Authorities announced the action on Oct. 26, 2026.

Police said the group stole 8.2 million records from more than 90 organizations, including schools, hospitals, corporations and golf courses.

Three insurance sales companies accounted for 3.22 million records, three funeral service companies for 1.43 million, and 21 golf courses for 1.2 million. 12 private academies lost 990,000 records, five hospitals 220,000, four universities 20,000, and 42 other businesses 1.12 million.

The stolen data included names, ID numbers, contact details, addresses, hospital patient records, minors’ data from academies, conglomerate management systems and financial institution bulletin boards. After the hacking, perpetrators sent threatening e-mails and text messages to targeted companies, warning that they would disclose the data if demands were not met.

In 38 incidents, the group demanded 360 million won, or about $270,000, and promised not to publish the stolen data. Investigators said the demands, made in cryptocurrency including Tether and other payments, targeted 38 companies. Only one small business paid 300,000 won because police caught them early, while investigators treated the other demands totaling 360 million won as attempted extortion.

The case began after a victim complained in June, and investigators traced the suspects using server logs from breached organizations. Police consolidated cases at the Seoul Cyber Investigation Unit as similar reports came in nationwide and began investigating in August. The team recovered stolen personal information four months after the investigation started.

The 32-year-old ringleader worked at a security company handling penetration testing between 2019 and 2022, according to the Seoul Metropolitan Police. Yonhap News reported that he taught himself hacking and began attacking organizations in September 2025, describing him as 32 years old.

Police said the ringleader used ARTEX AI, a penetration testing framework used to simulate attacks and find weaknesses, the same tool tied to bank breaches attributed to a Chinese-speaking threat actor. He initially used conventional tools and later adopted AI utilities in late August 2026. In the early stages, he used scanning tools for websites to conduct manual hacking and targeted companies ranked highly on portal search results that appeared able to pay settlement fees.

Police said artificial intelligence lowered the barrier for people launching cybercrimes, enabling large-scale attacks once limited to skilled actors. They called the case a prime example of the lower barrier to entry for AI-enabled crimes and deployed customized AI developed in-house during the investigation.

The Seoul Metropolitan Police Agency, backed by National Investigation Bureau high-performance AI computers, created an internal network generative AI analysis system that keeps investigative data inside, and built three specialized tools including one for network intrusion log analysis. Police called this the first domestic arrest in South Korea tied to large-scale hacking and personal data theft using generative AI.

Police reportedly used a police-developed AI tool to analyze evidence they recovered. Investigators recovered the stolen personal information. Police plan to keep investigating, including claims from companies that have not reported damages and tracking crime proceeds. Police are still investigating whether any stolen data appeared on the dark web.

A police official said police will expand artificial intelligence use in the field against sophisticated crimes that exploit AI. “If you receive threats over the leakage of personal information, do not negotiate with the criminals and report it to the police immediately,” a police official said.