Image: Unsplash.
Use this if your business keeps customer records behind a website, a booking form or an admin page. The victims in this case were cram schools, hospitals, golf courses, universities and subsidiaries of large groups, not banks. Seoul police say one man, using AI tools, broke into about 90 of them. Of those 90, 75 had not reported it. Our verdict: the attack was ordinary, the reach was new, and the step most victims skipped was the one that cost nothing.
Event date: October 26, 2026, a briefing by the Seoul Metropolitan Police Agency (its press release was posted on October 27). First reports: Yonhap at 03:00 UTC on October 26, then Decrypt at 20:06 UTC and BleepingComputer at 21:08 UTC.
What happened
The police release says the agency's cyber investigation division caught seven people who, from September 2025 to October 2026, used generative AI and other tools to get into the systems of 90-plus Korean businesses. They took more than 8.2 million personal records and internal files, then emailed threats to the victims. One suspect is in custody; six are being investigated without detention.
The leader, a 32-year-old the police call A, was sent to prosecutors in custody on October 23. That referral covers about 900,000 records from the 15 businesses that had reported. The other 75 victims had not reported, and police say charges for those come after more investigation. The charges are intrusion under the Network Act, Article 71(1) items 11 and 14 (up to 5 years or 50 million won), and extortion and attempted extortion under Criminal Act Articles 350(1) and 352 (up to 10 years or 20 million won).
Screenshot: Seoul Metropolitan Police Agency press release, case summary (Korean). Captured October 27, 2026.
The case began in June 2026 with one victim's complaint. In August the Seoul agency took over the cases reported across the country. Five accomplices who pressed victims' staff by phone and text were caught from July to September, and the man who directed them over Telegram in early October. A was arrested on October 15 and detained on October 17, after investigators traced him through the victims' logs.
Where the AI comes in
The release says A had no IT degree, taught himself from blogs, and had done penetration testing work for security checks. At first he ran automated website vulnerability scanners by hand. Then he used generative AI to attack a much wider range of businesses, indiscriminately. Police confirmed he also used the "AI autonomous penetration testing system" (our translation) behind the recent data leaks at Korean financial firms.
The release doesn't name the tool. At the briefing it was named as ARTEX (News1, BleepingComputer). Oh Gyu-sik, who leads the agency's Cyber Crime Investigation Unit 2, explained the difference there. With the old scanners the user picks the right tool and types the commands; with ARTEX and a language model attached, you enter only the goal and the AI chooses the hacking tools and works out the method. With it, A got into about 60 businesses in a little over 40 days, two-thirds of all the victims. Decrypt puts it at 60 companies in 44 days, from August 31 to October 13.
Microsoft describes ARTEX as "an open-source penetration testing framework that can use any AI model," whose agents run a test "from reconnaissance through data exfiltration with little needed human interaction." Its interface can be switched to Korean. It is the same framework behind the ConnectWise breach Microsoft tied to Storm-0940 on October 21. On October 8 its developer posted that ARTEX "has been misused" and moved it to closed-source development (Asia Business Daily). A Chinese technology expert told AFP that the move would not remove copies already downloaded.
The extortion script
The emails threatened, in effect, pay or the data goes public, and warned that a public leak would bring brand damage, fines after a regulator's investigation, and damages suits from customers. Police counted 38 businesses threatened so far and 360 million won demanded in total, about $270,000 by BleepingComputer's conversion. Per News1, the stolen data included names, resident registration numbers, phone numbers and addresses, plus employee records and internal files. No card data was taken, police had seen no sign of resale on the dark web, and they have recovered the stolen data.
The phone pressure was outsourced. An accomplice recruited callers on Telegram with ads like "Looking for people to make simple phone calls for pay. Takes just 30 seconds" (Korea JoongAng Daily). Their job was to call and text the victims' employees about the breach and push them to pay.
Screenshot: Seoul Metropolitan Police Agency press release, extortion method, damage and advice to companies (Korean). Captured October 27, 2026.
The playbook: six steps
- Assume you are on the list. A tool that picks its own targets doesn't care how small you are. Write down everything you run that faces the internet: the website, booking and contact forms, admin pages, old subdomains, the staging copy nobody turned off. Then scan it yourself with the same kind of automated website scanner A started with, and patch or take down what it finds. CISA's ransomware guide puts it as "conduct regular vulnerability scanning", especially on internet-facing devices, and points to CISA's own no-cost scanning service.
- Keep logs long enough to matter. A was identified from the victims' logs. The intrusions ran from September 2025 to October 2026, so a log that keeps only two weeks shows a sliver of an attack like this one. Find out how long your host keeps web and admin logs, and copy them somewhere the web server can't delete. CISA's line is to "retain and adequately secure logs from network devices, local hosts, and cloud services."
- Brief whoever answers the phone. The calls and texts to staff were part of the script, made by people hired for 30 seconds of work. Give front-desk and support staff one rule: nobody discusses a data threat on the phone, everyone forwards it to one named person, and that person writes down the number and the time.
- Report before you reply. The Seoul police ask any company threatened with a data leak not to negotiate with the criminals or send money, and to go to the police at once. The FBI's position is the same: it "does not support paying a ransom," because paying guarantees nothing and encourages more attacks. In the US, file at IC3 with the attacker's email address, the amount demanded and whether anything was paid; CISA's guide adds CISA itself, your FBI field office and the Secret Service.
- Start the breach notice clock. In Korea, Article 40 of the PIPA Enforcement Decree requires a filing with the PIPC or KISA within 72 hours when data leaks "due to illegal external access", whatever the count, or when 1,000 or more people are affected. There is a narrow exception: no filing is needed once the leak path is confirmed, the data is recovered or deleted, and the risk to people is substantially reduced. Article 39 sets the same deadline for telling the people affected. Outside Korea, your state or national law sets the clock; our incident reporting obligations guide covers the main ones.
- Save what the police will ask for. Keep the full extortion email with headers, every phone number and text, any payment address or account named, and a copy of your logs from before you start fixing things. Per CISA's guide, preserve evidence that is "highly volatile in nature" or "limited in retention" first.
Screenshot: FBI Internet Crime Complaint Center, "Ransomware" page. Captured October 27, 2026.
Screenshot: Enforcement Decree of the Personal Information Protection Act, Article 40, English translation by the Korea Legislation Research Institute. Captured October 27, 2026.
Our take: the extortion email works by making the regulator sound like the threat. Under Korea's decree a hack has to be filed within three days anyway, so filing first takes that lever away. Police are now checking for victims who paid, or who stayed quiet for fear of retaliation. Seventy-five of the ninety had not come forward. One complaint started the case.
What to log
- The date and time the threat arrived, by which channel, and who saw it first.
- Each filing: police or IC3 reference, PIPC or KISA filing, the time of each.
- When you notified the people affected, and how.
- Where the preserved logs and the original email are stored, and who can open them.
- The results of each scan from step 1, with the date and what you fixed.
What we checked
- The police release, October 27: we read the Seoul Metropolitan Police Agency release in Korean on its website. The 15 reported and 75 unreported victims, the statutes and the advice to companies come from it.
- Our own server, October 27: this site runs on an Ubuntu 24.04 server behind nginx. The log rotation file that comes with Ubuntu's nginx package keeps 14 daily access logs; the oldest one on disk was from October 14. That would not cover a case like this one. Your host may differ, which is the point of step 2.
- The rules: Article 40 of the PIPA Enforcement Decree in the Korea Legislation Research Institute's English text, which carries the September 12, 2023 amendment; the FBI's IC3 ransomware page; CISA's #StopRansomware guide.
What people said
In the subreddits and on Hacker News, we found no discussion of the arrests on October 27. The earlier r/cybersecurity thread on ARTEX going private shows why closing the code mattered little. On October 8, u/DsDman asked: "The GitHub seems to have been made private. Does anyone have a recent fork on GitHub?" A reply pointed to one.
No embed: there is no official video or post on the arrests we could embed, and the police footage on Korean news sites is marked not for reuse.
What we could not confirm
- The tool's name. The police release says "AI autonomous penetration testing system" (our translation) and doesn't say ARTEX. The name comes from News1 and BleepingComputer reporting on the briefing.
- How much was paid. The release gives only the 360 million won demanded. News1 and Decrypt put the only confirmed payment at 300,000 won; a Yonhap subheading has the group taking 300 million won. We could not settle it.
- Which AI models. Neither the release nor the coverage we read names the language model used with the tool.
- The victims. Police haven't named them. A is a suspect; no court has ruled.
