South Korean Police Break First Case of Non-IT Personnel Using Generative AI for Large-Scale Hacking: Over 90 Institutions Breached, 8.2 Million Records Stolen
South Korean police reveal the first case where non-IT personnel used generative AI autonomous penetration testing systems to attack over 90 institutions and extort money, confirming AI has significantly lowered the barrier to advanced cybercrime.
According to reports by South Korea's Electronic Times and Yonhap News Agency, the Cyber Investigation Division of the Seoul Metropolitan Police Agency disclosed a new type of cybercrime on October 26, 2026. A 32-year-old individual named A, who lacks an IT background, along with accomplices, used generative artificial intelligence (AI) technology to launch hacking attacks against more than 90 institutions—including training centers, hospitals, golf courses, universities, and subsidiaries of large corporations—starting in September 2025. They stole approximately 8.2 million personal information records and internal data. Police have arrested and referred A to prosecutors on charges of violating the Information and Communications Network Act and extortion; six other accomplices are under investigation without detention.
The investigation revealed that A was not a computer science major but self-taught hacking techniques through blogs and had worked in simulated penetration testing at a security company from 2019 to 2022. Initially using traditional vulnerability scanning tools, A began leveraging generative AI to expand the scope of attacks starting in late August 2025. Notably, the 'AI Autonomous Penetration Testing System,' recently implicated in financial sector data breaches, was also used in this crime. Of the 90+ victimized institutions, 60 were attacked with AI assistance.
After stealing data, the gang sent threatening emails to victim companies, claiming that exposure would damage corporate image and lead to government fines, demanding money in return. Thirty-eight companies suffered both hacking and extortion, with total demands reaching 360 million won. Police emphasized that this is the first domestic case in South Korea where suspects were apprehended for large-scale hacking and personal data theft utilizing generative AI. This fact demonstrates that with AI tools, individuals without professional hacker backgrounds can now execute large-scale cyberattacks that previously required highly specialized teams.