“High risk, no reward:” hackers’ attempt to extort 38 organizations in South Korea nets just $226
Crime doesn’t always pay.
South Korean police officer. Photo by Tsuguliev/Shutterstock
Follow us
- South Korean police arrested the suspected ringleader and questioned seven suspects in the cybercrime case.
- Police say the group stole 8.2 million records from more than 90 organizations.
- The group allegedly tried to extort 38 organizations but received only $226 from one company.
- Reports say the suspects used AI tools, but the stolen data’s final status remains unclear.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Another group of criminals has found that it might have been better off focusing on legitimate jobs.
South Korean police busted a cybercrime ring and arrested its suspected ringleader after the group managed to make a couple of hundred bucks after stealing 8.2 million pieces of personal data and other internal records from more than 90 organizations.
Local South Korean media report that police have identified 7 suspects who are being questioned, while the alleged ringleader, a 32-year-old man, has been arrested.
Police suspect that, since at least September 2025, the group has used AI tools to hack 60 of 90 various undisclosed organizations, including hospitals, private academies, and businesses.
According to the reports, the suspected crime ring tried to extort KRW 360 million ($271,000) from 38 organizations in total, threatening to leak stolen information that reportedly included customer and employee data.
However, South Korean broadcaster SBS said that only one company paid KRW 300,000 ($226).
Check if your data was exposed
Find out if your email and related personal information have appeared in known data breaches.
Meanwhile, Yonhap News Agency reports that the suspected ringleader learned hacking while working at a security company, where he was responsible for simulated hacking tests.
As the operation flopped, commenters online have largely focused on the irony of the failed ransom attempts and the low payoff relative to the effort and risk: "crime really doesn’t pay," "high risk no reward," and "bro would have made more money getting a job."
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
However, some focused on the fact that almost all companies refused to pay to protect their customer data. It's not clear what happened to the stolen data after the suspected criminal group was caught.
In either case, as reported by Cybernews, AI-powered ransomware has already arrived. For example, an AI agent carried out a ransomware attack independently, exploiting vulnerabilities and encrypting data entirely on its own.
In a separate case, during an AI agent-supported ransomware attack, a human attacker also left an 80-page security audit for the victim company.
