{
  "id": "seoul-data-theft-campaign",
  "url": "https://ohshit.app/incidents/seoul-data-theft-campaign/",
  "title": "Seoul police report 8.2 million records stolen across about 90 organizations",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-10-26",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "South Korea",
    "data theft",
    "AI"
  ],
  "ecosystems": [],
  "summary": "Seoul police allege a campaign stole 8.2 million personal-data records from about 90 organizations. Yonhap puts AI-assisted attacks at about 60 organizations, a figure unverified independently. Records are not unique people.",
  "splash": "About 90 South Korean organizations, including hospitals, academies and golf courses; specific attack prerequisites are unpublished",
  "wipe": "Preserve evidence, report extortion and investigate access paths; no campaign-wide patch or indicator list has been published",
  "in_the_wild": "n/a",
  "source_exception": "No accessible original Seoul police notice was located after searches of police.go.kr, smpa.go.kr and korea.kr. Yonhap and Edaily independently report the October 26 police briefing; technical details remain undisclosed.",
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Preserve and report extortion evidence",
      "hint": "Police advise reporting promptly rather than negotiating or paying. Preserve original messages and access logs for investigators."
    },
    {
      "title": "Scope exposure with your incident responders",
      "hint": "General response guidance: review database and administrative access logs, preserve evidence before changing systems, and close access paths your investigation confirms. No public CVE, fixed version or campaign indicator list is available."
    },
    {
      "title": "Verify what the affected operator confirms",
      "hint": "Use the organization's official breach notices to determine which records concern you. The reported total does not identify unique people or prove that every organization lost the same types of data."
    }
  ],
  "sources": [
    {
      "name": "Yonhap — Seoul police investigation",
      "url": "https://www.yna.co.kr/view/AKR20261026075100004",
      "says": "Reports 8.2 million records, about 90 organizations, AI use against about 60 (unverified independently), and extortion demands against 38 organizations; describes arrest and referral dates.",
      "primary": false
    },
    {
      "name": "Edaily — independent reporting on the police briefing",
      "url": "https://coinlab.edaily.co.kr/News/Read?mediaCodeNo=257&newsId=02955286645616856",
      "says": "Independently reports the scale and extortion targets; identifies ARTEX with coding-agent tools and relays police advice to report rather than negotiate or pay.",
      "primary": false
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Reported data theft; no specific vulnerability or affected software version is disclosed.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 15, 2026",
      "title": "Principal suspect arrested",
      "body": "Yonhap reports the arrest of the alleged campaign leader."
    },
    {
      "date": "Oct 23, 2026",
      "title": "Case referred to prosecutors",
      "body": "Police referred the principal suspect in custody; six others were investigated without detention."
    },
    {
      "date": "Oct 26, 2026",
      "title": "Police publicly describe the campaign",
      "body": "Independent Korean reports describe about 90 affected organizations and 8.2 million stolen personal-data records."
    }
  ],
  "body_markdown": "Yonhap and Edaily report police allegations of a campaign running from September 2025 into October 2026. Reported AI use began in late August 2026; it does not describe every intrusion throughout the campaign. Edaily identifies ARTEX combined with coding-agent tools. The alleged leader previously worked in penetration testing: describing this as an inexperienced novice's attack would be misleading.\n\nBoth outlets report demands totaling about KRW 360 million against 38 organizations. That is money demanded, not verified losses. Yonhap's subheading suggests substantial proceeds, but its body describes demands; Edaily reports only KRW 300,000 actually paid, unverified independently. Police recovered stolen data and were investigating possible onward distribution; recovery does not establish that no copies remain.\n\nThe reports do not publish exact flaws, authentication requirements, affected versions or technical indicators. They also do not establish a shared actor with the separate [ConnectWise cloud-backup incident](/incidents/connectwise-cloud-backup/), which also involved ARTEX. The checklist's investigation steps are general response guidance, not a vendor-confirmed fix. These are allegations in a criminal investigation, not findings of guilt."
}