Seoul police say a gang used ARTEX, an AI security-testing tool, to break into organizations and steal records.
Source: Newsis (Seoul police briefing)The alleged broader campaign began in September 2025. Police described the later AI phase at an October 26 briefing.
Police say the operator added ARTEX to existing hacking tools.
Newsis (Seoul police briefing)The reported AI phase affected about 60 organizations.
Hankyung (Seoul police briefing)Stolen information became leverage for human-delivered threats.
Newsis (Seoul police briefing)Editorial analogy: a burglar adds a powered tool to an existing operation. It may change how much work can be attempted, while people still choose the purpose.
An analogy for the mechanism; not an additional claim about the incident.Police attribute about 60 affected organizations to the AI phase. The broader campaign allegedly reached about 90 organizations and 8.2 million records. Hankyung (Seoul police briefing)
Demands totaled KRW360 million; police confirmed only KRW300,000 paid. Newsis (Seoul police briefing)
These are police allegations, not convictions or independent forensic verification.
The broader totals include activity before AI use.
A link to other ARTEX campaigns is not established.
Editorial lesson: data theft can harm people even when the extortion payment is small. Keep separate accounts of access, stolen information, payment demands and confirmed losses.
People directed the tools and delivered extortion threats. Newsis (Seoul police briefing)
Police arrested the suspected leader and referred the case to prosecutors. Further investigation continued. Newsis (Seoul police briefing)
Editorial connections for organizations protecting their services. The reporting does not establish which controls were missing.
Identify public-facing services, test their access restrictions, and prioritize repairs that protect private records.
The published police account does not identify the exact vulnerabilities. Testing cannot guarantee that every route is closed.
Preserve access records, investigate unusual data collection, and give responders a way to coordinate evidence and extortion reports.
Victims cannot control an external attacker’s AI. Responding quickly cannot retrieve every copy of stolen information.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Read this case’s update history →
Reviewed Oct 31, 2026 · Editorial methodology · Structured data