Seoul police: 8.2 million records stolen from about 90 organizations with AI help

Police in Seoul say a small group stole about 8.2 million personal records from about 90 organizations in South Korea, including hospitals, cram schools, insurance sellers and golf courses, and then tried to extort money from them. According to police, the group’s leader used an AI hacking tool to speed up the break-ins.^{1, 2}

Reporting checked October 27, 2026.

Too long; didn’t read?

• Seven suspects have been arrested; the alleged leader was sent to prosecutors in custody on October 23.¹
• The records reportedly include names, resident registration numbers, phone numbers and addresses, plus some hospital consultation notes and children’s details from cram schools.²
• The group demanded a total of 360 million won from 38 organizations; police say only one small business paid, 300,000 won.²
• Police are still checking whether any of the data was published on the dark web.¹

What police say happened

According to police, as reported by BleepingComputer, the attacks began in September 2025. The alleged leader is a self-taught 32-year-old who had worked in penetration testing, which is legally probing companies’ systems for weaknesses, at a cybersecurity firm between 2019 and 2022. He was arrested on October 15 and sent to prosecutors on October 23; all seven suspects have been arrested, but only the leader remains in custody.¹

Police say that from late August 2026 he began using a Chinese-made AI penetration tool called ARTEX, combined with an AI coding assistant. Once he named a target website, the tool reportedly chose the right techniques by itself and exploited weaknesses in databases and admin pages without step-by-step instructions, which police say rapidly increased the scale of the attacks.² BleepingComputer reports the tool was used in most of the attacks.¹

What was taken

Edaily, reporting the police briefing, says the records included names, resident registration numbers, contact details and addresses, hospital patients’ consultation records, and minors’ information from private academies (hagwon). The group also accessed internal company systems.²

Police broke down the roughly 8.2 million records like this:²

• 3 insurance sales companies: 3.22 million
• 3 funeral service companies: 1.43 million
• 21 golf courses: 1.2 million
• 12 private academies: 990,000
• 5 hospitals: 220,000
• 4 universities: 20,000
• 42 other businesses: 1.12 million

The organizations have not been named publicly. Note that 8.2 million is a count of records, not people: the same person can appear in several databases.

Why this matters

In South Korea, the resident registration number is a lifelong ID number used by banks, phone companies and public services. Combined with a name, phone number and address, it is exactly what voice-phishing gangs need to sound like a real bank, hospital or government office. Hospital notes and children’s records add another layer: details people would never want shared.

The case also shows how AI tools are changing attacks. Police say one person with a security background could break into dozens of organizations far faster once an AI tool did much of the work.^{1, 2}

The extortion

Police say the group demanded a total of 360 million won, in the Tether cryptocurrency and other forms, from 38 companies. Only one small business paid, 300,000 won; the other demands were charged as attempted extortion because the suspects were caught early.² Investigators traced the group through server logs from the hacked organizations.¹

What you can do if you are in South Korea

• Watch for notices from hospitals, academies, insurers or other organizations you deal with. Under Korean law, an organization that leaks your data must tell you what was exposed and what you can do.³
• Be suspicious of calls and texts that know a lot about you. A caller who knows your name, ID number or child’s academy is not proof they are genuine. Hang up and call the organization back on a number you look up yourself.
• Report suspected voice phishing to the police scam line at 1394.⁴
• Get advice about your personal data from the Personal Information Infringement Report Center at 118 or privacy.kisa.or.kr.⁵

If you run a business and receive a threat like this, report it to the police instead of negotiating or paying.

Sources

1. BleepingComputer, October 26, 2026: Former pentester used ARTEX AI to steal 8.2 million data records
2. Edaily, October 26, 2026: Non-tech-major AI hacker steals 8.2 million records via Artex
3. Personal Information Protection Commission, March 2024: Manual on responding to personal information leaks (in Korean)
4. Korea.kr, February 6, 2026: National Police Agency integrated report line 1394 (in Korean)
5. Personal Information Portal: How to report a personal information complaint (in Korean)