What happened
On 26 October, Seoul police announced that they had arrested seven people over a hacking and extortion campaign that ran for 13 months. Police say the group broke into about 90 organisations and took around 8.2 million records of personal data, along with internal company documents. They describe it as the first large-scale case in South Korea of criminals misusing generative AI to hack.
The victims included golf courses, private tutoring academies, hospitals, universities, insurance sales firms, funeral services firms, a regional mutual finance institution and an affiliate of a large conglomerate. Some of the academy data was about children. One funeral services firm lost 1.22 million records on its own.
The alleged ringleader is a 32-year-old man. He has been referred to prosecutors on charges of breaching the country's information and communications network law, extortion and attempted extortion. Six alleged accomplices are under investigation.
The money was supposed to come from extortion. Emails told 38 organisations that their data had been stolen and demanded 360 million won between them, around £200,000. When companies didn't pay, accomplices recruited on Telegram through adverts for "simple phone work" rang and texted executives and staff. Police say one company paid: 300,000 won, less than £200.
Only 15 of the victims had reported the attacks, and police believe there are more who haven't come forward. Investigators picked up the trail after one victim complained in June, then used an in-house AI tool to sift around 530,000 pieces of evidence, such as call and account records.
Sources: Seoul Economic Daily, 26 October 2026, Decrypt, 26 October 2026 and Money Today (in Korean).
What the viral post gets wrong
The post gets the number of victims about right. The rest is shakier, and the details change the lesson.
It says he wasn't a real hacker. He studied arts and physical education rather than IT, and he told police he taught himself from YouTube and blogs. But from 2019 to 2022 he worked for a security company carrying out simulated attacks, which is penetration testing by another name. He was a trained tester long before he picked up AI.
It says he hit major banks. The organisations police described were golf courses, tutoring academies, hospitals and the like, and the nearest thing to a bank was the regional mutual finance institution. The bank story belongs to a different case. Korean media report that one of his tools was also used in a recent breach at a Korean financial firm, but police haven't linked the two.
It says swarms of AI agents were probing banks around the clock. The reports describe one man with two tools: an AI coding agent and an autonomous penetration-testing system. That should worry businesses more than the swarm story, because anyone can get hold of both.
What the AI tools changed
For most of the campaign he worked the old way, police say, running website vulnerability scanners himself. At the end of August he added the two AI tools. Police link 60 of the roughly 90 breaches to the six weeks that followed, which leaves about 30 for the year before.
According to police, the AI helped him choose his tools and plan each step, and an attack on this scale used to need a hacking group rather than one person. Korean media name the autonomous tool as ARTEX, an open-source framework that uses AI agents to automate a penetration test, from mapping a target to taking its data. It's free, and it was built for testing. On 21 October, Microsoft said a China-aligned group had used the same framework to automate attacks on hundreds of organisations.
The way in didn't change. Police haven't said which flaws he used, but the reports describe weaknesses in websites, which he was already finding with ordinary scanners before AI was involved. What the AI tools changed was the cost. Each attempt took less time and less skill, so a golf course or a tutoring academy became worth his while.
Sources: Money Today (in Korean) and The Register on Microsoft's findings, 22 October 2026.
Why it matters in the UK
The Korean victims are the kind of organisations that rarely think of themselves as targets. What they had in common was personal data in systems that could be reached from the internet, and that describes a great many UK businesses.
In the government's latest Cyber Security Breaches Survey, 43% of UK businesses reported a breach or attack in the previous 12 months, including 42% of micro businesses. The National Cyber Security Centre expects AI to make attacks more frequent and more intense. It says the gap between a flaw being made public and attackers exploiting it "has shrunk to days", and that AI will almost certainly shrink it further.
Sources: Cyber Security Breaches Survey 2025/26 and NCSC: Impact of AI on cyber threat from now to 2027.
What to do about it
Most of the defences are ones you'll have heard of. What has changed is how quickly a gap gets found, so work through them now rather than at your next review.
- Know what you have online. List every website, booking or payment page, customer portal, admin login and remote access service, including old ones nobody uses any more. Attack tools start by building that list for themselves. Our guide to your website's attack surface covers where to look.
- Patch internet-facing systems first. Cyber Essentials allows 14 days for high-risk and critical updates. On anything the internet can reach, aim to beat that.
- Turn on multi-factor authentication for email, admin accounts and remote access. Tools like ARTEX automate attacks on passwords too.
- Keep less personal data. One funeral services firm lost 1.22 million records. Decide how long you need customer data and delete it after that, so there's less to steal.
- Have your websites tested, not only your network. This campaign came in through websites. Testing at the speed these tools work needs AI agents too, with a person checking what they find.
- Decide now what you'd do if someone demands money. Korean police told victims not to pay and to report straight away. In England, Wales and Northern Ireland, report it to Report Fraud; in Scotland, call Police Scotland on 101. If personal data is involved and the breach puts people at risk, you must tell the ICO within 72 hours of finding out. Warn your staff too: in this case the calls and texts went to employees, not just executives.
How Zarco helps
We test with AI agents too, because that's how attacks work now. The agents do the volume, mapping what you have exposed and trying what an attacker would try, at the same pace. An experienced tester confirms every finding before it reaches you and retests once you've fixed it. If the basics aren't in place yet, start with Cyber Essentials: its five controls are designed to stop the most common internet-based attacks.