Seoul police report 8.2 million records stolen across about 90 organizations
Seoul police allege a campaign stole 8.2 million personal-data records from about 90 organizations. Yonhap puts AI-assisted attacks at about 60 organizations, a figure unverified independently. Records are not unique people.
- Disclosed
- Oct 26, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- About 90 South Korean organizations, including hospitals, academies and golf courses; specific attack prerequisites are unpublished
- South Korea · data theft · AI
- In the wild
- Not applicable
- Reported data theft; no specific vulnerability or affected software version is disclosed.
What happened
Yonhap and Edaily report police allegations of a campaign running from September 2025 into October 2026. Reported AI use began in late August 2026; it does not describe every intrusion throughout the campaign. Edaily identifies ARTEX combined with coding-agent tools. The alleged leader previously worked in penetration testing: describing this as an inexperienced novice’s attack would be misleading.
Both outlets report demands totaling about KRW 360 million against 38 organizations. That is money demanded, not verified losses. Yonhap’s subheading suggests substantial proceeds, but its body describes demands; Edaily reports only KRW 300,000 actually paid, unverified independently. Police recovered stolen data and were investigating possible onward distribution; recovery does not establish that no copies remain.
The reports do not publish exact flaws, authentication requirements, affected versions or technical indicators. They also do not establish a shared actor with the separate ConnectWise cloud-backup incident, which also involved ARTEX. The checklist’s investigation steps are general response guidance, not a vendor-confirmed fix. These are allegations in a criminal investigation, not findings of guilt.
Crime-scene timeline
Oct 15, 2026
Principal suspect arrested
Yonhap reports the arrest of the alleged campaign leader.
Oct 23, 2026
Case referred to prosecutors
Police referred the principal suspect in custody; six others were investigated without detention.
Oct 26, 2026
Police publicly describe the campaign
Independent Korean reports describe about 90 affected organizations and 8.2 million stolen personal-data records.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Yonhap — Seoul police investigationReports 8.2 million records, about 90 organizations, AI use against about 60 (unverified independently), and extortion demands against 38 organizations; describes arrest and referral dates.
- Edaily — independent reporting on the police briefingIndependently reports the scale and extortion targets; identifies ARTEX with coding-agent tools and relays police advice to report rather than negotiate or pay.