Police in South Korea have broken up a cybercrime ring accused of using generative AI to hack about 90 domestic companies, steal roughly 8.2 million personal records, and demand money in exchange for silence. Investigators believe the group’s leader, who never studied IT, used AI to rapidly expand the range of targets.
Seven Suspects Tied to the Cybercrime Ring
On the 26th, the Cyber Investigation Division of the Seoul Metropolitan Police Agency said it had apprehended seven people, including the 32-year-old ringleader, identified as A, on suspicion of extortion and violating the Information and Communications Network Act. A has been detained, while the other six are being investigated without detention.
The group allegedly broke into the systems of around 90 companies from September last year through this month, taking personal information and internal data. Victims included private academies, hospitals, golf courses and affiliates of major conglomerates. The suspects reportedly warned, “If you don’t pay, we’ll leak the information,” and pointed to the reputational harm, surcharges and damages lawsuits a public breach could bring as extra pressure.
How AI Widened the Attacks Across South Korea
A is believed to have learned hacking through blogs and other sources and worked in penetration testing at a cybersecurity company from 2019 to 2022. Early on, A used automated tools to find website vulnerabilities, but from August this year expanded the attacks using generative AI and an AI-powered autonomous penetration system. Police believe about 60 of the roughly 90 victim companies were hacked with AI’s help.
Digital forensic evidence, A’s statements, and other materials pointed to about 8.2 million stolen records. The cybercrime ring demanded a total of 360 million won from 38 companies, but swift arrests limited its takings to just 300,000 won. Police are also examining whether other companies paid quietly or never reported the threats.
Tracking Down the Cybercrime Ring
The investigation began after one victim company filed a report in June. As similar cases surfaced nationwide, police consolidated them in August. From July to September, officers arrested five accomplices involved in the threats one after another, and early this month caught another who had directed the crimes via Telegram.
Police searched A’s residence in Yeoksam-dong, Gangnam-gu, Seoul, on the 13th, inspecting the generative AI running on a computer used in the crimes. After tracing access logs from victim companies and other records, they arrested A on the 15th and seized computers, hacking tools and accounts used to send threats.
On the 23rd, A was sent to prosecutors in custody on suspicion of stealing about 900,000 records from 15 companies that had filed reports. Police plan to investigate allegations involving the roughly 75 remaining companies that have yet to report.
A First for South Korea
Police called it the first case in South Korea in which suspects were caught running a large-scale hacking and data theft operation that exploited generative AI. They said it shows the barriers to cybercrime are falling, as individuals, not just professional hacker groups, can now use AI to attack multiple companies in a short time.
Authorities will keep identifying additional victims and accomplices while tracing the proceeds of the crimes.
