DOSSIER 002 · FIELD NOTES
A former pentester, an AI pentest suite and 8.2 million stolen records
South Korean police have arrested seven people over breaches at more than 90 organisations, and say the leader used the ARTEX AI pentest framework in most of the attacks. Here's what's been reported and what I'd fix first.
South Korean police have arrested seven people over a run of breaches at more than 90 organisations in the country. They say 8.2 million records were stolen, and that an AI penetration testing framework called ARTEX was used in most of the attacks. I think it's one of the clearest examples yet of what AI tooling does for an attacker who's only moderately skilled.
What happened
According to BleepingComputer, citing Korean media and the Seoul Metropolitan Police, the gang leader is a self-taught 32-year-old who worked at a cybersecurity company as a penetration tester between 2019 and 2022. He started attacking organisations in September 2025.
In 38 of the incidents he demanded ransom payments of 360 million won (about US$270,000) in exchange for not leaking the stolen data.
Police opened a case after a victim complained in June, and traced the suspects through server logs from the breached organisations. All seven were arrested. The leader was arrested on 15 October, formally detained two days later and referred to prosecutors on 23 October. The other six are still under investigation but haven't been detained. Police are now checking whether any of the data has turned up on the dark web.
What changed when AI came in
For his first year he used conventional tools. In late August 2026 he moved to AI tooling, specifically the ARTEX AI pentest suite, to expand the attacks. Police say it's the same autonomous framework used in earlier attacks on several South Korean banks that were attributed to a Chinese-speaking threat actor.
The police summed it up plainly: AI has lowered the barrier to entry, and attacks at a scale that once needed skilled, knowledgeable people are now within reach of individuals. They described it as the first arrest in Korea for large-scale hacking and personal information theft that exploited generative AI.
Who got hit
The victims weren't exotic targets. They included educational institutes, hospitals, large corporations and golf courses. That's a wide spread of ordinary businesses, and plenty of them won't have had a security team watching their web apps.
What I'd fix first
Nothing reported here suggests a novel technique. An autonomous pentest framework works through the same weaknesses a human tester would, just faster and without getting bored. So the fixes are the boring ones, and they matter more now.
- Take admin pages off the internet. CMS logins, database admin tools and vendor management consoles should sit behind a VPN, zero trust access or at least an IP allow list. If you don't know what's exposed, run an external scan of your own ranges and domains this week.
- Get your web apps tested. If a public-facing app hasn't had a proper test in the last year, or has changed a lot since, book one. Assume attackers are already running automated testing against it.
- Lock down the databases behind your sites. Web app database accounts should have the least privilege they need, databases shouldn't be reachable from the internet, and personal data should be encrypted and kept only as long as you need it.
- Keep your logs. This case was cracked through server logs from the victims. Make sure your web and access logs are kept long enough and stored somewhere an attacker can't wipe them.
If your admin pages are reachable from the internet and your web apps haven't been tested in a while, assume someone with a cheap AI setup can get to them this week.
Source
Former pentester used ARTEX AI to steal 8.2 million data records, BleepingComputer.