Former Pentester Arrested in South Korea Over AI-Driven Data Breaches

South Korean law enforcement authorities have arrested seven individuals in connection with a cybercrime campaign that compromised more than 90 domestic organisations, resulting in the theft of 8.2 million records.

The Seoul Metropolitan Police confirmed that the group’s alleged leader, a 32-year-old former penetration tester with prior experience at a cybersecurity firm between 2019 and 2022, adopted generative artificial intelligence tools to escalate the scale and speed of his operations.

Escalation Through Autonomous AI Tools

According to police disclosures, the suspect initiated cyberattacks against South Korean targets in September 2025 using conventional hacking tools. In late August 2026, the operation incorporated the ARTEX AI penetration testing framework, enabling autonomous capabilities that significantly widened the scope of the intrusions.

The compromised entities include educational institutions, healthcare facilities, commercial corporations, and recreational sites. Across 38 separate incidents, the perpetrator attempted to extort victims, demanding ransom payments totalling approximately 360 million won ($270,000) in exchange for deleting stolen data.

Investigation and Referral to Prosecutors

Police launched an investigation in June after receiving a complaint from a victimised organisation. Forensic investigators analysed server logs and deployed specialised analytical tools to trace the infrastructure linked to the suspects.

Officers arrested all seven individuals on 15 October. The primary suspect was formally detained two days later and referred to prosecutors on 23 October, while six accomplices remain under investigation without detention.

Law enforcement officials noted that the case represents the first arrest in South Korea involving large-scale personal data theft directly facilitated by generative AI frameworks. Investigators are continuing to monitor dark web marketplaces to determine whether any exfiltrated records have been leaked.