Seoul police have arrested seven members of a group that used generative AI to hack about 90 South Korean firms, steal personal data and demand money. The leader, in his 30s, is not an IT graduate but learned from blogs and YouTube; police called it the first arrest of a suspect in an AI-assisted hacking case.
According to the Kyunghyang Shinmun, the Seoul Metropolitan Police Agency's cyber investigation unit arrested seven people, including the group's leader, a man in his 30s, on suspicion of violating the information and communications network act and of extortion. They are suspected of using generative AI since September last year to break into about 90 Korean companies and take more than 8.2 million personal records along with internal files. Police said it is the first time a suspect in an AI-assisted hacking crime has been caught.
광고 문의 · 300×250The leader is not an IT major. The paper reported that he taught himself hacking from internet blogs and YouTube, though he is said to have worked on penetration testing at a security firm from 2019 to 2022. This paper does not publish details that could identify the suspect.
The victims span many sectors, including affiliates of large conglomerates, universities, hospitals, cram schools, golf courses and funeral-service firms, the Kyunghyang Shinmun said. The crimes began with automated tools that look for website weaknesses and later shifted to using AI to multiply the number of targets.
Methods and the demands for money
Police said the group also used methods like the 'AI autonomous penetration-testing system' seen in a hacking case in the financial sector. It then threatened by email, phone and text message to leak the data unless paid, warning of reputational damage, regulatory fines and class-action damages suits if the breach became known.
Thirty-eight companies were threatened, with demands totalling 360 million won. The Kyunghyang Shinmun reported that police suspect other firms did not report out of fear of retaliation and are investigating further offences. Whether any money actually changed hands was not confirmed in the report.
How the case unfolded and what remains
The investigation began in June when one company filed a report. As similar reports followed, the Seoul unit took the case, arresting five members one after another between July and September. In early October it caught one accomplice who directed the crimes over Telegram, then analysed evidence to identify the leader, who was arrested and detained on the 15th.
The leader was first referred to the prosecution service on the 23rd on suspicion of taking about 900,000 records from 15 companies. The other members are being investigated without detention and are due to be referred soon. Police said that even groups that are not professional hackers can now carry out large-scale hacks with AI help, and that they will bring more AI into investigations. Park Chun-sik, a professor at Ajou University, said it is still early and more varied, larger crimes could follow, urging investigators to build countermeasures first.
