The Ministry of National Defense building [Park Hae-muk]
The Ministry of National Defense building [Park Hae-muk]

Three active-duty officers of the Armed Forces Medical Command are undergoing disciplinary proceedings over the mismanagement of the command's mobile picture archiving and communication system, or PACS, which allowed unauthorized individuals to access the personal medical records of military personnel.

The Ministry of National Defense said Friday that an investigation into the unauthorized access found that three people, including active-duty officers of the medical command, had been referred for disciplinary action in connection with the "Defense Medical Information System Performance Improvement Project," and that the relevant procedures are now under way.

PACS is a system that stores medical images — including X-rays, computed tomography scans and magnetic resonance imaging scans — and allows medical staff to retrieve them.

Last month, a joint investigation team comprising the Ministry of National Defense, the Armed Forces Cyber Command, the Defense Counterintelligence Command and the medical command found that approximately 8 gigabytes of data — equivalent to about 1,000 images — had been accessed abnormally between November and December last year.

Six military hospitals are suspected to have been affected: those in Goyang, Yangju, Pocheon, Gangneung, Guri and Daegu. Enlisted soldiers, non-commissioned officers, commissioned officers and general officers all use these facilities.

However, whether any data was actually leaked has not yet been confirmed.

Unauthorized individuals were able to access the PACS through an open communication port.

It was also revealed that the communication port, which could serve as an entry point for intrusion, had remained open from November last year through March this year.

After becoming aware of the breach, military authorities posted notices on the websites of the medical command and the affected hospitals in accordance with the Personal Information Protection Act, and began notifying individuals whose contact information could be verified.

The mobile PACS service has been suspended since April 14 and remains offline. The Defense Ministry plans to develop measures to prevent a recurrence, given that the system's communication port had been managed in a state vulnerable to security breaches.


rimsclub@heraldcorp.com