A 32-year-old suspect with no technology background used AI to hack around 90 organizations, steal 8.2 million records, and demand about USD 270,000.

The Seoul Metropolitan Police Agency announced earlier this week that it had arrested seven people linked to a generative AI-powered cyberattack campaign that infiltrated the systems of around 90 organizations and stole 8.2 million data records. According to police, this is the first time in South Korea that suspects in a large-scale cyberattack campaign supported by AI have been arrested. The group demanded a total of around USD 270,000 in ransom from its victims.

The victims ranged from hospitals, universities, private test-preparation centers, and golf courses to subsidiaries of major conglomerates. All held people’s names, contact details, and personal records. A funeral services company alone had 1.22 million records stolen, while data from training centers reportedly included information about minors.

According to local media, the 32-year-old suspected ringleader, who had studied art and physical education, said he had taught himself attack techniques through YouTube and blogs. However, police said he had previously worked on cyberattack simulations at a cybersecurity company from 2019 to 2022, a detail that makes the image of an AI-empowered “amateur” less convincing.

At first, the suspect used tools to scan websites for security vulnerabilities. From late August, he added an AI coding agent capable of writing and executing code on its own, along with an automated penetration-testing system that local media identified as Artex. As a result, 60 companies were breached in just 44 days, from August 31 to October 13.

Police said that an operation on this scale would previously have required a whole team of hackers, but now a single individual can carry it out in a short time. The entire campaign lasted about 13 months, from September 2025 to October 2026; the investigation began in June after a victim filed a complaint.

Has AI really “democratized” cybercrime?

The criminal misuse of AI has increased in recent years, but most of the information has come from AI developers themselves rather than law enforcement agencies. In 2023, WormGPT, a ChatGPT-like tool with no safety safeguards, was used to compose phishing emails.

In August 2025, Anthropic said that a perpetrator had used Claude Code to extort at least 17 organizations, demanding ransoms of between $75,000 and $500,000 in Bitcoin. In November, the company announced that a state-sponsored Chinese hacking group had used Claude to carry out 80–90% of the activities in an espionage campaign targeting around 30 targets, although only a few of the intrusions were successful.

Academics, meanwhile, have offered a more cautious perspective. Analyzing 97,895 topics on cybercrime forums, researchers from the universities of Cambridge, Edinburgh, and Strathclyde found that AI’s impact was concentrated mainly in areas that were already automated, such as SEO fraud, bot accounts, and romance scams. There was little evidence that AI coding tools helped less-skilled perpetrators outperform those using ready-made scripts.

The suspected ringleader was remanded in custody and referred to prosecutors last Friday, facing charges of violating laws on information and communications networks, extortion, and attempted extortion. Police are continuing to investigate six accomplices and identify additional victims, as 15 organizations have already reported losses.