Police say the operation breached more than 90 organisations, including hospitals and educational institutions. The alleged leader has been referred to prosecutors while investigators check whether stolen data was leaked.
South Korean police have arrested seven suspects over an operation they allege breached more than 90 organisations and stole 8.2 million records. BleepingComputer said on October 26 that the figures came from local reporting citing Seoul Metropolitan Police, including coverage by Yonhap News.
Police opened the case after a victim complained in June. Investigators traced the suspects through records of activity on the breached organisations’ servers.
Police said the affected organisations included educational institutions, hospitals, large corporations and golf courses. In 38 incidents, the alleged attacker demanded ransom payments of 360 million won ($270,000), promising not to leak the stolen data in exchange.
Police said the alleged leader had experience in penetration testing—checking computer systems for security weaknesses—and worked at a cybersecurity company between 2019 and 2022. Yonhap News dated the start of his alleged attacks to September 2025.
The police account says he initially used conventional tools, then adopted superintelligence (SI) tools in late August 2026 to expand the attacks, with the penetration-testing framework “ARTEX AI” used in most of the operation’s attacks.
The same framework was also reported in separate attacks on South Korean banks attributed to a Chinese-speaking attacker. Those bank breaches are distinct from the operation involving the seven suspects.
Police said the alleged leader was arrested on October 15, formally detained two days later and referred to prosecutors on October 23. He remains in custody. The other six suspects remain under investigation without detention.
Police are continuing their investigation, focusing on whether any of the stolen data has been leaked on the dark web.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min
