South Korea arrests man for hacking 90 institutions using AI tools

Police in Seoul arrested a 32‑year‑old man with no formal IT training after he used generative‑AI tools to breach the networks of about 90 hospitals, schools and private firms, then demanded roughly $270,000 in ransom payments. The suspect, identified only by his age, was taken into custody on Thursday following a months‑long investigation by the cybercrime division of the Seoul Metropolitan Police Agency. Prosecutors say he leveraged AI‑driven code generators and vulnerability‑scanning scripts to automate the attacks and to craft convincing phishing emails that tricked staff into revealing credentials.

The case is the first major instance in South Korea where artificial intelligence has been directly linked to large‑scale hacking. Experts say AI lowers the technical barrier for criminals, allowing people with limited coding skills to produce functional malware, exploit scripts and social‑engineering content in minutes. South Korea, one of the world’s most digitally connected economies, has seen a surge in ransomware and data‑theft incidents since the pandemic, prompting lawmakers to tighten cyber‑security regulations. The arrest comes as the government pushes a new “AI‑Safety Act” that aims to monitor the misuse of generative models and to require companies to report AI‑related threats.

Investigators say the hacker first scanned public IP ranges for outdated software, then fed the findings into an AI code‑assistant that generated exploit code tailored to each target. He sent the malicious payloads via email, posing as IT support staff, and once inside the networks, he encrypted files or threatened to leak sensitive data unless the victims paid in cryptocurrency. Over the course of the campaign, he extracted about 300 million won from a handful of larger hospitals and a cluster of private schools, while smaller businesses reported losses of a few hundred thousand won each. Police recovered the cryptocurrency wallets used for the payments and traced them to a local exchange that has now frozen the accounts.

The suspect faces charges of illegal intrusion, extortion and violation of the Personal Information Protection Act. Prosecutors are expected to seek a prison term of up to five years, reflecting the seriousness of AI‑enabled crime. The police chief warned that similar attacks could become more common as AI tools become cheaper and more accessible, urging organizations to adopt zero‑trust architectures and to train staff on AI‑generated phishing. The Ministry of Science and ICT announced plans to launch a public awareness campaign on AI‑related cyber threats and to work with tech firms on rapid detection tools, signaling a broader policy shift to curb the emerging risk.