The Pulse
South Korea Refers Detained AI-Theft Ringleader to Prosecutors
A 32-year-old alleged ringleader was referred to prosecutors while in detention in a case involving 8.2 million records stolen from more than 90 organizations. The other six suspects remain under investigation without detention.
AI.info Team · Written with AI · fact-checked ·
“Even individuals who are not part of professional hacker groups can now conduct large-scale hacking with the help of AI.”
Seoul Metropolitan Police Agency, as quoted by CHOSUNBIZ
South Korean police referred a detained 32-year-old alleged ringleader to prosecutors in a case involving the theft of 8.2 million pieces of personal information and internal records from more than 90 organizations. The other six suspects were still facing questioning, according to Yonhap News Agency’s report on Oct. 26, 2026.
More than 90 organizations targeted
Police say the alleged operation ran from September 2025 until recently. Investigators suspect the group used AI tools to hack 60 of its targets. The reported total of more than 90 organizations covers the broader list of entities from which the suspects allegedly stole data and other internal records.
The distinction matters: Yonhap’s account does not say that AI was used in every intrusion, nor does it describe the specific tools, models or systems involved. Police have not publicly detailed the vulnerabilities the group allegedly exploited or the types of internal records taken.
38 entities faced demands totaling 360 million won
Of the targeted entities, 38 suffered losses, and the group demanded a combined 360 million won—about US$272,000—from them, Yonhap reported. Police characterize the extortion as an attempt; the reported figure is the amount demanded, not a confirmed sum collected.
The demands turned the alleged breach into a pressure campaign against affected organizations. The reported scale—millions of data items across a wide range of institutions—also leaves open questions about how many people may be represented in the records. Yonhap’s report does not provide a count of individual victims.
The 32-year-old leader was referred to prosecutors
Police referred the group’s 32-year-old alleged leader to prosecutors on Friday, Oct. 23, while he was in custody. The six other suspects were being investigated without detention and remained under further questioning, Yonhap reported and CHOSUNBIZ said.
Yonhap described the alleged leader as a self-taught hacker who learned hacking skills while working at a security company, where he was responsible for simulated hacking attacks. The report did not name the suspects or say what charges prosecutors may ultimately pursue.
Police have not detailed AI’s precise role
CHOSUNBIZ separately reported that police described the case as South Korea’s first domestic arrest tied to large-scale hacking and personal-information theft exploiting generative AI. The agency’s warning points to the potential reach of AI-assisted attacks, but the available account does not establish that an autonomous system carried out the intrusions on its own.
For now, the public description is narrower: police allege that the suspects used AI tools in some of the attacks, stole data from more than 90 entities, and sought money from 38. The specific AI workflow and the number of people affected remain undisclosed.