Incident·WS-0145·Oct 15, 2026·disclosed Oct 26, 2026 (11 days later)·in the wild·AI-powered cyberattacks

Seoul police arrest seven who used generative AI to hack about 90 Korean organizations and take 8.2 million records, then demanded 360 million won from 38 of them

Seoul Metropolitan Police Agency; a self-taught coder named as ringleader and six accomplices; about 90 victim organizations including hospitals, golf courses, universities, private academies and conglomerate subsidiaries

40/100
WS-3 Serious
Harm score 60, signal score 16. Autonomy: tool (a person misused it). How the scores work.
Harm 3/5
damage actually done
Reach 4/5
who was affected
Autonomy 0/4
how much the AI did on its own
Novelty 2/5
how new the behavior was
Permanence 2/5
how hard it is to undo

The Korea JoongAng Daily reported on Oct 26 (16:38 KST) that Seoul police had arrested seven people for using generative AI to hack about 90 Korean organizations between September 2025 and October 2026, stealing 8.2 million records of personal information and internal documents. The group sent threatening emails to 38 organizations demanding a combined 360 million won (about $272,000) to keep the data private, and an accomplice recruited people through Telegram to call and text employees of the targeted organizations to press them to pay. The investigation began in June after a victim's complaint; six suspects were arrested between July and September and the alleged ringleader, who had no IT training and is reported to have taught himself through online resources, on Oct 15. Police say they recovered all of the stolen personal records and describe it as Korea's first arrest in a large-scale AI-assisted hacking case; a police official said the investigation into accomplices and further victims continues.

Damage

8.2 million records taken from about 90 organizations; extortion demands totalling 360 million won against 38 of them; police say the personal data was recovered

Sources

Korea JoongAng Daily. Evidence confidence: medium. Dated to the ringleader's arrest (Oct 15); disclosed Oct 26. Single English-language report so far; the police briefing itself was not located by this run, and how much of the hacking the AI did (code generation, target selection) is not specified beyond 'using generative AI'. Harm 3 for millions of records exposed; reach 4 on record count rather than on a verified count of people; irreversibility 2 because police say the data was recovered, which cannot exclude copies. Autonomy 0: humans using AI as a tool. Whether any of the 38 organizations paid is not stated.

Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.