He started by running vulnerability scanners by hand. Once he added AI, he was breaching about a company a day. The skill didn’t change. The tooling did.

On 26 October, the Seoul Metropolitan Police Agency announced seven arrests in what Korea JoongAng Daily reports is the country’s first arrest in a large-scale AI-assisted hacking case. Police say the group breached some 90 organisations between September 2025 and October 2026 (hospitals, golf courses, universities, private academies and subsidiaries of major conglomerates) and stole 8.2 million records, including personal data and internal documents. It then sent threatening emails to 38 victims, warning of “regulatory fines and lawsuits from customers”, and demanded a combined 360 million won. Seoul Economic Daily reports that the 32-year-old ringleader, who had worked on simulated hacking at a security firm from 2019 to 2022, began with manual vulnerability scanners, then used an AI coding agent and an autonomous AI penetration testing system to breach 60 companies in just over 40 days, from 31 August to 13 October. Police said that tool was the same one used in a recent financial-sector breach, but no link between the cases has been confirmed. Accomplices recruited on Telegram for “simple phone work” then called and texted staff to push for payment. Only 300,000 won was paid. The Herald Business reports that he was sent into custody on Friday, charged so far over about 900,000 records from the 15 companies that had filed complaints, and that the stolen data included names, resident registration numbers, phone numbers and addresses.

Two assumptions just broke. First, that mass compromise needs a skilled crew: one person with prior pentest experience plus AI tooling hit dozens of organisations in weeks. Second, that small, unglamorous targets are safe because nobody bothers with them. Academies holding minors’ data, a funeral services provider that lost 1.22 million records and a regional mutual finance institution were all on the list. AI made breadth cheap. For APAC leaders, the lesson isn’t Korea-specific: your exposed web apps are now being tested at machine pace, and the extortion that follows lands in your staff’s inboxes and phones, not your SOC console.

What security leaders should do:

• Assume your internet-facing web apps get an automated, AI-driven test every week; patch and retire forgotten sites and admin panels on that cadence.
• Inventory where personal data sits in small business units, subsidiaries and partner-run sites, not just the core estate.
• Brief executives and front-line staff that breach-extortion emails, calls and texts are an attack phase, with one clear reporting path.
• Pre-agree the extortion playbook: do not pay and report to police immediately, as Seoul police urge, then preserve evidence and meet your regulator’s breach-notification duties.
• Watch for scanning bursts and bulk data exports from web apps; AI speeds up the attack but still leaves logs.

AI didn’t give this attacker new skills. It gave him more hours in the day.

Disclaimer: This post was researched and written by AI agents working with Philip Sow. Every source is linked so you can check the facts. Views are personal and do not represent any employer.

#AISecurity #DataProtection #Extortion #APAC #CyberSecurity

Sources: Korea JoongAng Daily · Seoul Economic Daily · The Herald Business