Vulnerabilities · AI Security
AI tool Artex linked to theft of 8.2 million records in South Korea
South Korean police say a cybercrime gang used the AI pentesting tool Artex to steal 8.2 million records from over 90 organisations, including hospitals and schools.
Ross GrantUpdated 2 min read
The short version
A group in South Korea used an AI tool called Artex to break into over 90 organisations and steal millions of data records. The group targeted places like hospitals and schools. Police arrested seven suspects and are still investigating. This is one of the first big hacking cases in Korea involving AI tools.
By the numbers
- 8.2 milliondata records stolenBleepingComputer
- 90+organisations breachedBleepingComputer
- $270,000ransom demanded in 38 casesBleepingComputer
- 7suspects arrestedBleepingComputer
What happened?
South Korean police say a cybercrime gang used the AI pentesting tool Artex to steal 8.2 million records from more than 90 organisations, including hospitals and schools. The group’s leader, a former penetration tester, was arrested in October 2026. Police say the attackers demanded ransom in 38 cases. The investigation is ongoing, with authorities checking if stolen data has been leaked.
Who is affected
South Korean police say the group targeted more than 90 organisations, including educational institutes, hospitals, large corporations and golf courses. The attacks affected a broad range of sectors, showing that the threat was not limited to a single industry. Victims included both public and private entities, according to BleepingComputer (opens in a new tab).
What was taken
Authorities believe the attackers stole 8.2 million data records. The police have not detailed exactly what information was in these records, but the scale suggests a mix of personal and possibly sensitive data. In 38 cases, the attackers demanded ransom payments totalling 360 million won (about $270,000), threatening to leak the stolen data if not paid.
How the attack worked
The group’s leader, a former penetration tester, began targeting organisations in September 2025. At first, the group used conventional hacking tools, but in late August 2026, they switched to using the ARTEX AI penetration testing suite. This tool automates tasks like scanning for weaknesses, password attacks, and exploiting access, making it easier to break into systems at scale. Police say the use of AI lowered the barrier for large-scale attacks, allowing even less experienced criminals to cause serious harm. Investigators traced the suspects through server logs from breached organisations and used their own AI tool to analyse evidence.
The response
South Korean police identified and arrested seven suspects. Only the group’s leader, a 32-year-old self-taught hacker, remains in custody as of late October 2026. The investigation began after a victim filed a complaint in June. Police say this is the first arrest in Korea for a large-scale hacking and data theft case involving generative AI. Authorities are now checking if any of the stolen data has been leaked on the dark web.
What you should do
For organisations, this case highlights the need to monitor for unusual activity, review access controls, and keep software up to date. The use of AI in attacks means defenders should consider how automation could be used against them and invest in detection tools that can spot automated threats. Regular staff training and incident response planning remain essential.
Why it matters
This case shows that AI tools can make it easier for criminals to carry out large-scale attacks, even if they are not highly skilled. Organisations need to be aware that automated hacking tools are now a real threat. Defenders must adapt their security measures to keep up with these new risks.
Key points
- AI pentesting tool Artex used to breach over 90 organisations in South Korea
- 8.2 million data records stolen, including from hospitals and schools
- Attackers demanded $270,000 in ransom in 38 cases
- Police arrested seven suspects, with one main organiser in custody
- AI tools are making large-scale cyberattacks easier for less skilled criminals
Sources
SC Media
Reference
BleepingComputer
Reference
