ARTEX AI: 8.2 Million Records Stolen from 90+ South Korean Organizations

South Korean police have identified seven suspects in a cybercrime operation that breached more than 90 organizations across the country and stole 8.2 million data records, using the ARTEX AI penetration testing framework in most of the attacks, according to BleepingComputer, which reported the findings on October 26, 2026, citing Yonhap News and the Seoul Metropolitan Police. The victims include educational institutes, hospitals, large corporations, and golf courses, and in 38 of the incidents the attackers demanded ransom payments of 360 million won, roughly $270,000, in exchange for not leaking the stolen data. All seven suspects were arrested in the operation, which police describe as the first arrest case in Korea tied to large-scale hacking and personal information theft that exploited generative AI.

What was the specific vulnerability?

The attackers did not exploit a single software flaw: they weaponized a legitimate AI-powered penetration testing framework, ARTEX, to scale intrusions across dozens of South Korean organizations. According to BleepingComputer, the gang's leader is a self-taught 32-year-old hacker with a penetration-testing background who worked at a cybersecurity company between 2019 and 2022. He began attacking organizations in September 2025 and adopted AI utilities in late August 2026 to expand the campaign, meaning the most aggressive phase of the operation ran for roughly two months before the October arrests.

The tooling has a documented track record beyond this case. In a separate campaign against South Korean banks including Shinhan Bank, KB Kookmin Bank, and Hana Bank, BleepingComputer reported on October 10, 2026 that CrowdStrike confirmed the use of the same ARTEX AI autonomous pentesting suite. CrowdStrike investigators found open directories containing Claude Code session histories, ARTEX configuration files, and Claude memory files, and determined that the ARTEX instance used DeepSeek v4.1-flash as its primary LLM backend, supplemented by GLM-5.3 from Zhipu AI and Grok 4.6. The bank attacks exposed client personal data and credit card information and caused service outages, and CrowdStrike's reporting attributed them to a possibly 26-year-old Chinese national.

How was the incident detected?

Police opened the case after a victim filed a complaint in June 2026, and investigators traced the suspects through server logs of the breached entities. According to BleepingComputer, the Seoul Metropolitan Police also used an in-house AI tool to analyze the recovered evidence, mirroring at the investigative level the same class of technology the suspects had deployed for the attacks. The timeline from complaint to custody ran just over four months: the gang leader was arrested on October 15, 2026, formally detained two days later on October 17, and referred to prosecutors on October 23, 2026. All seven suspects were arrested; only the leader remains in custody, while the other six are under investigation without detention.

In a statement carried by BleepingComputer, police said: "This is the first case of arrest of a suspect in Korea related to a large-scale hacking and personal information theft crime that exploited generative AI." The same statement added: "Even individuals who are not professional hacker organizations can now hack on a large scale with the help of AI." That framing places the case at the center of an ongoing policy question in South Korea about how offensive AI tooling, built for authorized security testing, converts into criminal capability when it leaves the professional environment.

What is the current impact?

More than 90 South Korean organizations are confirmed breached, with 8.2 million personal data records stolen and 38 victims extorted for approximately $270,000 each, per BleepingComputer. The extortion mechanics followed a consistent pattern across those 38 incidents: the threat actor demanded 360 million won per victim and promised not to leak the stolen data in exchange, a scheme that monetized the breach directly while leaving the underlying exposure of 8.2 million records in place regardless of whether any individual victim paid. The related ARTEX campaign against Shinhan Bank, KB Kookmin Bank, and Hana Bank exposed client personal data and credit card information and caused service outages, according to BleepingComputer.

The tooling itself has outlived the arrests. After confirming that ARTEX was used in real-world attacks, its developer made the project closed-source and discontinued updates, but existing code has already spawned English- and Korean-language derivatives that remain available. The developer's response therefore limits future official distribution without removing copies already in circulation.

What are the next steps?

The gang leader is in custody awaiting prosecution, and the six co-suspects are under investigation without detention. Police are still checking whether the stolen data has leaked to the dark web, according to BleepingComputer, so the full exposure of the 8.2 million records remains an open question until that review concludes. On the tooling side, the ARTEX developer's move to close the source and halt updates does not address the derivatives already in circulation, which leaves defenders facing continued availability of the framework independent of the original project. The referral of the leader to prosecutors on October 23, 2026 moves the case into the judicial phase, where the generative-AI dimension of the charges will be tested for the first time under Korean law.

By the numbers

Source snapshot