Zero Radar
← feed
HighData breachupdated 26 Oct 2026, 21:09 UTC

Former pentester used ARTEX AI tool to steal 8.2 million records

A cybercrime group used a hacking tool called ARTEX AI to break into more than 90 organizations in South Korea and steal millions of personal records. Anyone whose data was held by those organizations may be at risk of scams or identity mis

Attacks reported (BleepingComputer)1 source, unconfirmed
SeverityHighData breach
Being exploited?ReportedBy BleepingComputer, not officially confirmed yet
What to doCheck exposureReview logs for signs of unauthorized access and restrict use of the ARTEX AI framework in your environment.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Former pentesterInsider with security tool knowledge
  2. 2ARTEX AI frameworkPentesting tool repurposed for attacks
  3. 390+ organizationsSouth Korean targets breached
  4. 48.2M recordsPersonal data taken
  5. ResultMillions of records stolen

What happened

South Korean police identified seven suspects, including a former penetration tester, who used the ARTEX AI pentesting framework in most of the breaches of more than 90 organizations and stole about 8.2 million data records.

Why it is dangerous: Millions of stolen records create risk of fraud, phishing, and identity misuse for the people whose data was taken, and show that legitimate security tools can be turned into attack tools.

Are you affected?

You are affected if your organization or personal data was held by one of the South Korean organizations breached, or if you use the ARTEX AI framework.

ARTEX AI pentesting framework (as used in the attacks); more than 90 South Korean organizations breached.

What to do

  1. Check whether your organization was among the breached South Korean targets or holds related data, and review access logs
  2. Restrict and monitor use of the ARTEX AI framework in your environment
  3. Watch for phishing or fraud attempts that reference personal details, and enforce strong, unique passwords and multi-factor authentication

Timeline

  1. 26 Oct 2026, 21:08 UTC
    Publicly disclosed
  2. 26 Oct 2026, 21:08 UTC
    Reported by BleepingComputer · BleepingComputer
  3. 26 Oct 2026, 21:09 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-9b615396
Disclosed
26 Oct 2026, 21:08 UTC
On Zero Radar
26 Oct 2026, 21:09 UTC (1 min after disclosure)
Last change
26 Oct 2026, 21:09 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Former pentester used ARTEX AI tool to steal 8.2 million records · Zero Radar