Hackers use AI to breach 90 organizations, steal 8.2 million records and threaten, “Pay up or we’ll leak them”

[Financial News] Police have apprehended a group that used generative AI to hack about 90 domestic companies, including private academies, hospitals and golf courses, steal about 8.2 million records of personal information and demand money. Investigators believe the ringleader, who was not an IT major, rapidly expanded the range of targets using generative AI.
On the 26th, the Cyber Investigation Division of the Seoul Metropolitan Police Agency said it had apprehended seven people, including ringleader A, 32, on suspicion of violating the Information and Communications Network Act and extortion. A has been detained, while the other six are being investigated without detention.
They are suspected of breaking into the systems of about 90 domestic companies from September last year through this month, stealing personal information and internal company data, and threatening, “If you don’t pay, we’ll leak the information.” The victims included private academies, hospitals, golf courses and affiliates of major conglomerates. They also used the prospect that disclosure of the data breach could damage companies’ reputations, lead to surcharges and result in damages lawsuits as a means of pressure.
A is believed to have taught themselves hacking through blogs and other sources and to have worked on penetration testing at a cybersecurity company from 2019 to 2022. Early in the scheme, they used automated tools to find website vulnerabilities, but expanded the scope of their attacks from August this year by using generative AI and an AI-powered autonomous penetration system. Police believe about 60 of the roughly 90 affected companies were hacked in attacks that used AI.
An analysis of digital forensics evidence and A’s statements, among other materials, found that about 8.2 million records of personal information had been stolen. The group demanded a total of 360 million won from 38 companies, but swift arrests limited the amount collected to just 300,000 won. Police are also looking into the possibility that more companies either did not report the threats or paid the group without disclosing that they had been victimized.
Police began investigating after receiving a report from one victim company in June. When reports of the same method continued to come in from across the country, they consolidated the cases in August. They then apprehended five accomplices who had taken part in the threats, one after another, from July to September, and caught another accomplice who had directed the crimes via Telegram early this month.
Ringleader A was arrested on the 15th after police traced access logs from victim companies and other records. Police also searched A’s residence and seized computers used in the hacking, hacking tools and accounts used to make threats.
On the 23rd, A was sent to prosecutors in custody on suspicion of stealing about 900,000 records of personal information from 15 companies that had filed reports. Police plan to further investigate allegations involving the roughly 75 remaining companies that have yet to report the incidents.
Police said this was the first case in South Korea in which suspects were apprehended in a large-scale hacking and personal information theft operation that exploited generative AI. They said the case shows that the barriers to entry for cybercrime are falling, as even individuals, rather than professional hacker groups, can use AI to attack multiple companies in a short period.
Police plan to continue identifying additional victim companies and accomplices while tracing the proceeds of the crimes.

[email protected] Choi Seung-han Reporter