South Korean police have arrested a suspected hacking ringleader accused of stealing 8.2 million personal information records and internal data from about 90 organizations, using generative AI to expand his attacks. Victims included private academies, hospitals, golf courses, universities, and affiliates of major corporations. The Seoul Metropolitan Police Agency’s Cyber Investigation Division referred the 32-year-old suspect, identified only as A, to prosecutors in custody on October 23 on allegations involving network intrusion and extortion.
Hacker Uses AI to Exploit 90 Organizations Despite not majoring in information technology, the suspect reportedly learned hacking through blogs and online resources. Authorities indicated that the operation employed an "AI autonomous penetration testing system" tied to a recent personal information leak in the financial sector. However, the provided report fails to specify the system, disclose any exploited vulnerabilities, or clarify precisely which attack stages were automated.
These limitations are significant: the findings describe AI-assisted intrusions, not evidence that an autonomous system independently executed every stage of the campaign. Authorities reported recovering stolen personal information, but investigations into possible secondary offenses, including whether data reached dark-web markets, remain ongoing. The police described the arrest as South Korea's first case involving large-scale hacking and personal information theft through generative AI.
Explore for your team.
