A suspected hacker allegedly breached 60 South Korean organizations in just 44 days after adopting AI-assisted hacking tools, part of a wider campaign that compromised more than 8.2 million personal information records.
Seoul police announced the apprehension of seven suspects on Oct. 26 after investigating breaches affecting businesses, hospitals and educational institutions. Investigators accuse the group of threatening victims with disclosure unless they paid.
The case illustrates how AI-assisted tools can accelerate cyberattacks while leaving organizations to deal with the lasting consequences of stolen personal information.
AI tools accelerated a single hacker's campaign
Between Aug. 31 and Oct. 13, the alleged hacker breached 60 organizations using AI-assisted methods, Seoul police reported. Earlier in the campaign, he operated website vulnerability scanners manually before adopting an AI coding assistant and an autonomous penetration-testing system.
Police identified the suspect as a 32-year-old who taught himself hacking through online materials and worked in penetration testing at a security company from 2019 to 2022. Investigators also identified ARTEX among the tools used.
Given a target and an objective, the open-source system can examine exposed services and select subsequent testing methods based on its findings.
In controlled tests, AhnLab researchers observed ARTEX exploit a vulnerable file-upload feature. A separate experiment demonstrated its ability to execute commands on four internal machines after compromising an exposed server.
Those experiments demonstrate the tool's capabilities, but they do not establish that the suspect used the same techniques during the South Korean intrusions.
Stolen personal files became leverage for extortion
Compromised information included South Korean resident registration numbers and contact details, as well as employee records and internal business documents. Some academy files contained information about minors, while hospital data included patient consultation details. A funeral services company alone lost about 1.22 million records.
Extortion emails targeted 38 organizations, with suspects demanding a combined 360 million won (about $271,000). Messages warned that disclosure could damage the victims' reputations and lead to regulatory penalties or customer lawsuits. Only one organization was confirmed to have paid, transferring 300,000 won (about $226).
When recipients did not comply, accomplices contacted executives and employees through calls and text messages. Rather than demand payment to unlock encrypted systems, the group used data theft and extortion to pressure its targets with the prospect of public exposure.
Investigators opened the case after a complaint in June and traced the suspected hacker through server-access logs, arresting him Oct. 15. He was referred to prosecutors in custody on Oct. 23, while six other suspects remain under investigation without detention.
Only 15 victim organizations had filed complaints, leaving police to investigate the remaining cases and determine whether the information was distributed further.
Stolen records complicate incident response
For organizations targeted in data-theft extortion, determining the extent of the loss is important. A stolen database may contain multiple records belonging to one person, so security teams should establish how many individuals are affected and which types of information were compromised.
Findings like these reveal the scope of customer notifications and the protections victims may need.
When criminals provide samples of stolen information, investigators should preserve the evidence without assuming it represents everything taken. Comparing those samples with internal records and access logs can help establish the extent of unauthorized access.
Legal and privacy teams should assess notification obligations while administrators secure the affected systems.
Extortion without encryption also changes the recovery process. Restoring systems does not recover copied personal information, and paying criminals provides no guarantee that stolen records will be deleted. An incident response plan should therefore address data exposure and follow-on misuse, not just restoring affected services.
More cybersecurity news: Researchers warn that vulnerable iPhones can be infected with spyware through malicious ads and compromised websites, even without users clicking anything.