South Korean police arrest seven in alleged AI-assisted data theft

Police announced the arrests on Oct. 26, saying seven people were suspected of network-law violations and extortion.[1] The alleged ringleader, identified as A, was 32; police sent A to prosecutors in custody on Oct. 23, while the other six suspects were investigated without detention.[2] Police allege the group operated from September 2025 through October 2026, a period they described as 13 months.[3] The investigation began in June 2026 after one affected company filed a complaint.[3]

Police allege the group stole personal information and internal company data from about 90 entities, and used AI tools to hack 60 of its targets.[4] Those targets included academies, hospitals, golf courses, universities and affiliates of large corporations; police said the large hospitals commonly called the “Big Five” were not among them.[2][1] Of the targeted entities, 38 suffered losses, and the group demanded a combined 360 million won.[4] Police said it actually received only 300,000 won from one company.[3]

Police said A began using generative AI in late August to hack a broader range of companies indiscriminately.[2] They said an AI autonomous penetration-testing system, also used in a recent financial-sector data theft, was used in A’s hacking.[2] Police described the arrests as South Korea’s first in a case involving large-scale hacking and personal-information theft using generative AI.[2] A had no formal IT background and taught himself hacking techniques through blogs and other sources; he had worked at a security company conducting penetration tests from 2019 through 2022.[3]

The stolen information included customer names, resident registration numbers, phone numbers and addresses, as well as employee and internal business data.[1] Police said payment-card information was not leaked, that they had recovered the personal information the group stole, and that there was no current indication it had been redistributed on the dark web.[2][1] Police also said the tools reduced the personnel required for investigations and shortened the investigation period to four months.[3] They said they would continue investigating additional victims, accomplices and the proceeds of crime.[1]