South Korea: Police Uncover Theft of 8.2 Million Records and Extortion of Companies

On October 26, Seoul police announced a case involving the theft of 8.2 million personal data records from more than 90 organizations. Investigators say the perpetrators also used artificial intelligence tools and, after the breaches, demanded money in exchange for not leaking the information. Seven suspects are involved in the case.

What investigators found

According to the Yonhap news agency, the victims included educational institutions, hospitals, golf courses and businesses. The group’s activity reportedly began in September 2025. The police have now released the findings of their investigation. This is not a wave of new breaches from the past 24 hours.

The alleged ringleader previously worked as a penetration tester at a security firm. Police say he began making broader use of generative AI from late August 2026. Thirty-eight organizations received payment demands under the threat of having their stolen data published.

What remains unknown

The charges and the police findings do not amount to a final determination of guilt. Investigators are still examining whether the stolen information was sold or passed on. The number of records also does not necessarily equal the same number of distinct individuals.

Public reports give no basis for pointing to a single vulnerability or a single technique used against all of the organizations. Nor do they allow the full scale of the theft to be attributed solely to the use of AI. What matters in practice for administrators is the combination of intrusion, data theft and subsequent extortion.

What to do now

• Confirm that internet-facing applications and administrative interfaces have assigned owners and up-to-date software.
• Restrict application accounts to only the data they actually need to function.
• Retain logs that make it possible to detect unusual data reads and downloads.
• If you receive a payment demand, preserve the message and any evidence, and determine the scope of the breach based on your own systems.
• Verify that you can restore services, and review your procedure for handling suspected information theft.

SecurHUB commentary

Extortion over the publication of data requires a separate assessment of what was actually accessed or copied. Incident response can help organize the evidence, determine the scope of the breach and plan a return to secure operations.

Sources: Yonhap, BleepingComputer