South Korean Police Say Former Pentester Used ARTEX AI in Theft of 8.2 Million Records
Summary
South Korean police say seven suspects were linked to attacks on more than 90 organizations, with authorities believing 8.2 million records were stolen. The alleged leader reportedly used ARTEX AI in most attacks.
Key points
- South Korean police identified seven suspects linked to an operation that allegedly breached more than 90 organizations.
- Authorities believe the operation stole 8.2 million records from organizations including schools, hospitals, corporations, and golf courses.
- In 38 incidents, the actor reportedly demanded 360 million won ($270,000) in exchange for not leaking stolen data.
- The alleged leader, a former penetration tester, reportedly used the ARTEX AI penetration-testing suite in most attacks and adopted AI utilities in late August 2026.
- Investigators traced suspects using server logs from affected organizations; police also reportedly used an in-house AI tool to analyze recovered evidence.
- All seven suspects were arrested. The alleged leader remains in custody and was referred to prosecutors; the other six remain under investigation without detention.
- Police are investigating whether any of the allegedly stolen data was published on the dark web.
Article Details
- Victim Organization
- More than 90 organizations in South Korea; individual organizations were not named
- Incident Type
- Cyber intrusions, data theft, and extortion
- Disclosure Date
- 2026-10-26
- Data Types Exposed
- Personal information
- Affected Records
- Authorities believe 8.2 million records were stolen.
- Operational Impact
- More than 90 organizations were breached. The article does not report specific service outages or operational disruption.
- Ransom Or Extortion
- In 38 incidents, the threat actor demanded a total of 360 million won (approximately $270,000), promising not to leak the stolen data in exchange for payment.
- Claim Status
- alleged