A Hacker Used AI to Breach 90 South Korean Companies and Demanded $271,000, but Only One Victim Paid: $226

A 32-year-old with an arts and physical education background plugged AI into his hacking toolkit and broke into 60 South Korean companies in 44 days. Then he tried to cash in, and almost nobody paid. Out of roughly $271,000 demanded from 38 companies, one victim handed over about $226.

The Seoul Metropolitan Police Agency's Cyber Investigation Division announced on Monday that it had apprehended seven people, including the ringleader, on suspicion of extortion and violating the Information and Communications Network Act. The ringleader is detained; the other six are being investigated without detention. Police said it was the first time in South Korea that suspects in a large-scale AI-assisted hacking operation had been caught.

From scanners to an AI agent

Between September 2025 and October 2026, the group allegedly broke into about 90 organizations and took about 8.2 million records of personal and internal data. The victims were cram schools, hospitals, universities, golf courses and affiliates of major conglomerates. One funeral services provider lost 1.22 million records, and one report said the academy data included information on minors.

The ringleader has no IT degree and says he taught himself from YouTube and blogs. He did, however, work in penetration testing at a security company from 2019 to 2022, running simulated attacks for a living.

He began with ordinary website vulnerability scanners. In late August 2026 he added an AI coding agent and an autonomous penetration testing system that local reports name as Artex. Police say that is when the pace exploded: 60 companies in 44 days, from August 31 to October 13. An attack of that size once took a hacking group, police said, and AI now lets a single person do it quickly.

It fits a pattern. In August 2025 Anthropic said one criminal had used its Claude Code tool to run an extortion campaign against at least 17 organizations, demanding between $75,000 and $500,000 in Bitcoin. We saw the same speed recently when an AI agent attacker got into a European government in two hours.

The payday that never came

The extortion playbook was standard. The group threatened to leak the stolen data unless victims paid, and leaned on the extra fear of reputational damage, regulatory surcharges and damages lawsuits. In total they demanded 360 million won, about $271,000, from 38 companies.

Only one company paid, and it paid 300,000 won, roughly $226. Police are now checking whether other victims paid quietly or never reported the attacks at all.

The case started with a single report from a victim in June. Investigators consolidated the cases in August, arrested five accomplices involved in the threats between July and September, and early this month caught another who directed the crimes over Telegram.

AI scaled the break-ins far faster than it scaled the money. But the failed shakedown is cold comfort for the people in those databases. Police have not said what happened to the 8.2 million stolen records.

Some offers on this page may be paid placements or contain affiliate links.