AI Hacking: Self-Taught Hacker Steals 8.2 Million Records in South Korea

He didn’t study computer science. He didn’t work for a criminal hacking ring. According to police in Seoul, a man who is 32 years old taught himself to hack using blogs and YouTube videos, then used generative AI to break into about 90 companies and organizations across South Korea. By the time he was caught, his group had stolen roughly 8.2 million pieces of personal data and internal files.

When I first read this story, one thought kept coming back to me: if one person with no tech degree can do this, what does that mean for the rest of us? Let’s walk through what happened, why it’s a turning point and what you can do to protect yourself.

AI Hacking Case: Key Facts at a Glance

What happened: A group used generative AI to hack about 90 Korean businesses and organizations
What was stolen: About 8.2 million pieces of personal data and internal company files
Who was targeted: Private academies, hospitals, golf courses, universities and affiliates of large companies
The blackmail: 38 companies were threatened, with demands totaling 360 million won (about $260,000)
The arrests: Seoul police caught seven people, and the ringleader, who is 32, was sent to prosecutors in custody
Why it matters: Police say it’s Korea’s first case of an individual, not a professional hacking group, using AI for large-scale hacking

Keep reading to see how the scheme unfolded, how police cracked it and how to keep your own information safer.

A Hacker Without a Tech Degree

The man at the center of the case, identified only as Mr. A, had no formal background in information technology. Police say he picked up hacking skills on his own, learning from blogs and YouTube. He had also once done penetration testing work for a security company, the kind of job where experts are paid to find weak spots before criminals do.

That detail stings a little. The same knowledge meant to protect companies was turned against them.

At first, he relied on automated tools that scan websites for security holes. Later, he started using large language models, the same kind of AI behind popular chatbots. That’s when his attacks widened dramatically, from a handful of targets to dozens of businesses at once.

Who Was Hit

The group’s activity ran from September 2025 until this fall. The victims weren’t just big tech firms. They were the everyday places most of us trust with our information:

Private academies, where parents sign up their kids for classes
Hospitals and clinics
Golf courses and membership businesses
Universities
Affiliates of major Korean corporations

Think about how many forms you’ve filled out at places like these. Names, phone numbers, addresses, sometimes even health details. That’s exactly the kind of information that ended up in the wrong hands.

The Blackmail Playbook

Stealing the data was only half the plan. After breaking in, the group contacted the victims and sent them samples of the stolen data as proof. Then came the threat: pay up, or we’ll leak everything.

They knew exactly where to press. A public data leak can damage a company’s reputation, trigger government fines and lead to lawsuits from customers. The group used all of that fear as leverage. Accomplices also called and texted employees of the victim companies to keep up the pressure.

In total, 38 companies received threats, and the demands added up to about 360 million won, or roughly $260,000.

Here’s the surprising part. Officially, only one company paid, and it handed over just 300,000 won, about $220. But police believe the real number may be higher. Some businesses may have quietly paid and never reported it, worried about the bad publicity. Honestly, I understand the temptation, but staying silent only helps criminals keep going.

How Police Caught Them

The investigation began earlier this year, after one victim filed a complaint. As more similar reports came in, the Seoul Metropolitan Police Agency’s cybercrime unit took charge of the whole case.

Police tracked down the accomplices one by one. Between July and September, they arrested five people who had made threatening calls and texts. In early October, they caught a man, 24, who had recruited helpers through Telegram and handed out instructions.

The ringleader was finally identified by analyzing server logs and other evidence from the victims’ systems. Police arrested him on October 15, searched his home and seized the computers and accounts used in the scheme. He was formally detained on October 17 and sent to prosecutors on October 23. Six others are being investigated without detention.

And I love this twist: police say they used their own AI analysis tool to sort through the mountain of evidence quickly. AI helped commit the crime, and AI helped solve it.

Why This Case Is a Wake-Up Call

For years, large-scale hacking seemed like the work of skilled professionals or organized crime groups. This case shows how much that’s changing. Police specifically warned that, unlike in the past, even an individual can now pull off major hacks with AI’s help.

That’s a big shift. AI tools can speed up tasks that once took real expertise, like finding weak spots in websites or writing convincing messages. In the right hands, that helps security teams. In the wrong hands, it lowers the barrier to crime.

It also puts more pressure on smaller businesses. A local academy or clinic may not have a full security team, but it can still hold thousands of people’s personal details. Those are exactly the kinds of targets that AI-powered attacks can sweep up in bulk.

How to Protect Yourself From Data Leaks

You can’t control a company’s security, but you can make stolen information less useful to criminals. Here are the habits I’d recommend to anyone:

Use a different password for every site. A password manager makes this easy.
Turn on two-factor authentication wherever you can, especially for email and banking.
Be wary of unexpected calls, texts and emails, even if they mention real details about you. Leaked data often fuels scams.
Share only what’s necessary when signing up for services. If a field is optional, consider leaving it blank.
Watch for breach notices from companies you use, and change your password right away if you get one.
Keep your devices and apps updated so known security holes get patched.

What Businesses Should Take Away

If you run a business, even a small one, this case is a reminder to take security seriously:

Keep software and websites updated, and fix known vulnerabilities quickly.
Collect only the customer data you truly need, and protect what you keep.
Train staff to recognize suspicious calls and messages.
If you’re hacked or threatened, report it to the police instead of paying quietly.

Can AI Make Anyone a Hacker?

This case is a sobering example of how AI can be misused. A self-taught man of just 32, armed with online tutorials and AI tools, managed to hit about 90 organizations and steal 8.2 million records before police stopped him. At the same time, it shows that AI can work for the good guys too, helping investigators move faster than ever.

I don’t think the answer is to fear AI. But we do need to be smarter about how we protect our information, and companies need to keep up with the new risks. A few simple habits today could save you a big headache tomorrow.

Have you ever received a data breach notice or a suspicious message after a leak? Share your experience in the comments below.

AWESOME 2 AI