Seoul Metropolitan Police have identified seven suspects in a hacking spree against more than 90 South Korean organizations, local media reported on October 26. Police believe 8.2 million records were stolen. The account relies on press reports, including Yonhap, of the police disclosure.
Leader Arrested October 15 After a Year of Attacks
According to the reports, the leader is a self-taught 32-year-old who worked at a cybersecurity company between 2019 and 2022. He began the attacks in September 2025. Police say he adopted AI tools in late August 2026 to expand the operation.
Leader Detained October 17 and Referred to Prosecutors October 23
All seven suspects were arrested, but only the leader remains in custody. He was arrested on October 15, formally detained two days later and referred to prosecutors on October 23.
ARTEX AI Penetration-Testing Framework Drove Most Attacks
Police said most attacks used the ARTEX AI penetration-testing framework. The same autonomous framework was used in attacks on multiple South Korean banks that were attributed to a Chinese-speaking threat actor. Police did not tie the two sets of attacks to the same operators in the reporting cited.
Victims Included Schools, Hospitals, Corporations and Golf Courses
More than 90 organizations were breached, among them schools, hospitals, corporations and golf courses. Police estimate that 8.2 million records were stolen.
360 Million Won Demands in 38 Incidents
In 38 of the incidents, the actor demanded 360 million won, about $270,000, to refrain from leaking the stolen data. The reports do not say how many victims paid, if any.
What the ARTEX Case Shows About AI Penetration-Testing Tools
The case involves a former security industry employee who adopted AI tools in late August 2026 to expand his attacks.
The account depends on police statements relayed through local media, and the exact charges have not been detailed in the coverage reviewed. Prosecutors now hold the case against the leader.
Open Questions for Prosecutors in the ARTEX Hacking Case
The reports do not list the names of the victim organizations, the data types in the 8.2 million records, or the roles of the six other suspects. Police have not said whether the data was published or sold after the ransom demands.
The leader’s detention leaves the case with prosecutors rather than police, and the reports do not say whether the other six suspects face charges or remain free.
Timeline of the Investigation From September 2025 to Referral
The reports lay out a year-long timeline. The attacks began in September 2025. The leader adopted AI tools in late August 2026 to expand them. He was arrested on October 15, formally detained on October 17 and referred to prosecutors on October 23. Police disclosed the case on October 26.
Police said the victims were South Korean organizations, among them schools, hospitals, corporations and golf courses, and that more than 90 were breached. The estimate of 8.2 million stolen records is the police figure as relayed by local media. In 38 incidents the actor demanded 360 million won, about $270,000, not to leak the data.
The tool at the center of the case is the ARTEX AI penetration-testing framework. Reporting describes it as an autonomous framework and notes that it was also used in attacks on multiple South Korean banks, which were attributed to a Chinese-speaking threat actor. The reports present this as the same framework, not as evidence that the same people were involved.
The reports describe the case as showing AI penetration-testing frameworks lowering the bar for extortion crews. The response so far is that seven suspects have been identified, and that the leader is detained and referred to prosecutors.
