Seven suspects identified in alleged hacking operation targeting more than 90 organisations
South Korean police have identified seven suspects in an alleged cybercrime operation that compromised more than 90 organisations and resulted in the theft of approximately 8.2 million data records. Investigators say the suspected group used an artificial intelligence-powered hacking framework known as ARTEX AI to expand its attacks across multiple sectors.
According to a report by The420.in published on October 27, 2026, the affected organisations included hospitals, educational institutions, large corporations and golf courses. The case has raised concerns about how AI-enabled tools can be misused to automate cyberattacks and increase the scale of data theft.
Police described the investigation as the country’s first arrest involving large-scale hacking and personal information theft using generative AI.
How the Alleged Cybercrime Operation Began
According to Seoul Metropolitan Police, the suspected 32-year-old ringleader previously worked at a cybersecurity company between 2019 and 2022, where he was employed as a penetration tester.
Investigators allege that he began targeting organisations in September 2025, initially relying on conventional hacking tools. In late August 2026, he reportedly adopted AI-powered utilities, including ARTEX AI, to expand the operation.
Authorities believe the transition to AI-assisted techniques enabled the suspect to conduct attacks on a wider scale. The investigation is examining how the tools were used and how the alleged operation developed over time.
The allegations remain subject to the ongoing legal process.
How ARTEX AI Featured in the Attacks
Police identified ARTEX AI, described in the report as an autonomous penetration-testing framework, as a central tool in the alleged operation.
Penetration-testing technologies are generally designed to help security professionals identify weaknesses in computer systems. However, similar capabilities can be misused when deployed without authorisation.
The report also states that the framework had previously been associated with cyberattacks against multiple South Korean banks attributed to a Chinese-speaking threat actor. The supplied material does not establish a connection between that earlier activity and the suspects in the current investigation.
The case highlights concerns that AI-assisted automation may lower some of the technical barriers involved in conducting complex cyberattacks.
Ransom Demands and Millions of Records
Investigators believe approximately 8.2 million records were stolen from more than 90 compromised organisations.
The affected entities reportedly spanned several sectors, including healthcare, education and large businesses. The report does not specify the exact categories of personal information contained in the stolen records or confirm that every affected organisation experienced the same type of data exposure.
Authorities also identified 38 incidents in which the attacker allegedly demanded ransom payments totalling 360 million South Korean won, equivalent to approximately $270,000. The demands reportedly included promises not to disclose the stolen information.
Investigators are examining whether any of the data has subsequently appeared on dark web platforms.
How Police Traced the Suspects
The investigation reportedly began after a victim filed a complaint in June. Police examined server logs recovered from compromised organisations and used the digital evidence to trace connections to the suspects.
According to the report, investigators also used an internally developed AI tool to analyse recovered evidence.
All seven suspects were arrested. However, the alleged ringleader remains in custody, while the other six suspects are being investigated without detention, according to the supplied account.
The suspected leader was arrested on October 15, formally detained on October 17 and referred to prosecutors on October 23.
Implications for Cybersecurity and Businesses
The case illustrates the risks organisations face when attackers use automation and AI-assisted tools to expand unauthorised access, steal information or demand ransom payments.
Hospitals, educational institutions and businesses often maintain substantial volumes of sensitive information. Effective security therefore requires more than basic protection: organisations need timely vulnerability management, access controls, monitoring and incident-response procedures.
Companies responding to suspected financial irregularities or digital incidents may also need to assess potential losses and examine transaction records. Financial investigation services may be relevant when investigating suspected financial misconduct or tracing suspicious transactions.
The investigation also underscores the importance of distinguishing legitimate security testing from unauthorised activity. The capabilities of a tool do not determine whether its use is lawful; authorisation and the purpose of deployment are critical factors.
Investigation Continues
South Korean authorities are continuing to examine the alleged operation, including whether stolen information has been published or circulated online. The full extent of the exposure and any subsequent misuse remain unclear from the supplied report.
The case adds to growing concerns about AI-assisted cybercrime and the need for organisations to strengthen their ability to detect, investigate and respond to evolving digital threats.