Self-taught hacker and gang stole 8.2 million personal records from 90 firms

"We have stolen your data. If we do not hear from you by 1 p.m., we will release the information. Do not underestimate the reputational damage, regulatory fines and customer lawsuits your company will face."

A self-taught hacker who used generative AI and other tools to infiltrate more than 90 domestic companies and steal over 8.2 million personal records has been caught, along with six accomplices, after repeatedly attempting to extort money from the targeted firms. Thanks to a swift police response, actual losses amounted to just 300,000 won ($227), though the gang had demanded a total of 360 million won from victim companies.

The Seoul Metropolitan Police Agency's Cyber Investigation Division announced Monday that it had apprehended seven people — including the ringleader, a man in his 30s identified only as A, who has six prior convictions — on charges of violating the Act on Promotion of Information and Communications Network Utilization and Information Protection, as well as extortion and attempted extortion. One of the seven has been indicted in custody.

Police sent A into custody on Friday after charging him with stealing about 900,000 personal records from 15 companies that had filed complaints. Six co-conspirators, including B, a man in his 20s identified as the instigator, were referred to prosecutors without detention.

According to police, the group is suspected of breaking into the computer systems of more than 90 domestic companies between September last year and early October this year, using generative AI and other tools to steal more than 8.2 million personal records and internal documents.

The gang is believed to have used ARTEX, an AI-based penetration-testing tool suspected of being exploited in a recent large-scale financial sector data breach. In the roughly 40 days before their arrest — from August onward — they continued indiscriminate hacking attacks and stole personal data from 60 companies.

Victim companies ranged from hagwon and hospitals to golf courses and conglomerate affiliates.

The breakdown of victims includes 21 golf courses (about 1.2 million records), 12 hagwon (990,000 records), five hospitals (220,000 records), four universities (20,000 records), three funeral service companies (about 1.43 million records), three insurance sales firms (about 3.22 million records) and 42 other businesses (about 1.12 million records).

The stolen personal information included names, resident registration numbers, phone numbers and addresses. No credit card data was taken.

Ringleader A is a self-taught hacker who, according to the investigation, learned hacking techniques through blogs and YouTube videos. He had previously worked for a security firm for three years starting in 2019, conducting simulated hacking to check websites for vulnerabilities.

In the early stages of the scheme, A manually operated automated tools designed to find security vulnerabilities in websites. After incorporating generative AI, the scope of attacks expanded indiscriminately.

The group sent threatening emails and text messages to victim companies, demanding money in exchange for not releasing the stolen personal data and internal documents.

When rattled victims asked to negotiate a lower settlement, the gang pressured them further, threatening to leak the contents of those negotiations as well and demanding that the specified amount be transferred immediately.

The confirmed number of victim companies stands at more than 90, with over 8.2 million personal records stolen. While actual losses reached only 300,000 won, the gang had demanded a total of 360 million won from 38 companies. Police are working to recover the stolen data and investigating whether additional victims exist.

The investigation began in June after one victim company filed a complaint. As similar reports from across the country mounted, police designated the Seoul Metropolitan Police Agency's Cyber Investigation Division as the lead investigative body in August and launched a full-scale probe.

Between July and September, police arrested five accomplices who had called and texted employees at victim companies demanding money. In early October, they caught B, who had directed the others via Telegram. Police then analyzed access logs and related evidence from victim companies to identify ringleader A, arrested him on Oct. 15 and detained him two days later, completing the arrest of all seven members of the gang.

Police noted that even non-professional hackers can now carry out large-scale cyberattacks using AI, and responded by deploying their own internally developed investigative AI.

The Korean National Police Agency's National Investigation Headquarters provided the Seoul Metropolitan Police Agency with a high-performance AI computer. Seoul police used it to build an AI analysis system operating on an internal network to prevent investigative data from leaking externally, and developed three AI-based investigative analysis tools in-house.

"Using our own AI investigative system, we were able to swiftly apprehend the suspects just four months after launching the investigation," a police official said. "We will continue to counter AI-driven crime with AI technology, expanding its use in the field and actively responding to increasingly sophisticated cybercrime."