Hacking threats surge as AI spreads

Public sector hit 1.57 billion times through July

Government and private sector alike left exposed

Fragmented cyber defenses urgently need overhaul

Kim Jong-cheol, acting commissioner general of the Korean National Police Agency, listens to Prime Minister Han Seong-sook at a meeting on personal data breaches at financial institutions and public agencies, held Friday morning at Government Complex Seoul in Jongno-gu, Seoul. [Yonhap]
Kim Jong-cheol, acting commissioner general of the Korean National Police Agency, listens to Prime Minister Han Seong-sook at a meeting on personal data breaches at financial institutions and public agencies, held Friday morning at Government Complex Seoul in Jongno-gu, Seoul. [Yonhap]

From the passenger manifest of the presidential jet to credit information held by financial firms, sensitive data is leaking from public agencies and private companies alike. The spread of AI has lowered the barrier to launching cyberattacks, but security practices have failed to keep pace with the rapidly changing methods attackers now use.

Government officials have cited AI as one of the main drivers behind the rise in hacking incidents. A Korean National Police Agency official said cyberattacks have grown more frequent as AI makes them easier to carry out. In the past, skilled hackers had to analyze a target's vulnerabilities before breaking in; today, an attack can be launched with nothing more than an AI prompt.

Choi Woo-hyeok, director general for information security and network policy at the Ministry of Science and ICT, told a national audit session of the National Assembly's science and technology committee on Oct. 15 that AI-driven hacking can strike multiple targets simultaneously and automatically in a very short time. Choi added that, in connection with recent attacks targeting the financial sector, authorities are investigating the possible use of AI based on traces of "Artex," a Chinese autonomous hacking tool.

Cyberattacks and attempted intrusions against the public sector reached about 1.57 billion cases in the first seven months of this year. Data submitted to the office of Rep. Park Jeong-hyeon of the Democratic Party of Korea, a member of the National Assembly's Public Administration and Security Committee, by 44 central government agencies and 17 metropolitan and provincial governments showed that security systems automatically detected an average of about 7.4 million attacks and attempted attacks per day from January through July. Of those automatically flagged cases, officials confirmed 353,748 as actual attacks — more than double the 173,053 confirmed over the same period last year.

"Our security systems have been stuck in the past while attack methods have changed dramatically," a cybersecurity official said. "The time has come to move beyond security that exists only on paper and make it real."

Major cyber breaches and personal data leak incidents in 2026
Major cyber breaches and personal data leak incidents in 2026

Security awareness lags — internal negligence a leading cause of data leaks

Questions are also being raised about whether the agencies and companies that suffered breaches had fulfilled their security management responsibilities before the incidents occurred. A former senior cybersecurity official said that when security inspections are conducted, a significant number of institutions are found to have failed to follow even basic security protocols — such as setting proper passwords or maintaining network separation — before an incident strikes. "Institutions that handle information need to change their security mindset first," the official said.

A joint security audit of the National Election Commission conducted in 2023 by the National Intelligence Service, the Korea Internet & Security Agency and the commission itself found that the commission had been using simple, easily guessable passwords — such as "12345" — on its internal systems. The commission said at the time that only one program had been found with a password management problem and that the password was changed immediately after the inspection.

In practice, personal data breaches at public institutions are more often caused by internal negligence than by external hacking. Data submitted by the Personal Information Protection Commission to the office of Rep. Park Sung-hoon of the People Power Party, a member of the National Assembly's Political Affairs Committee, showed that of 144 public-institution personal data breach cases fully adjudicated from 2022 through August this year, 86 — or 59 percent — were caused by negligence in the course of official duties. That is 2.3 times the 37 cases, or 25 percent, attributed to hacking. The 144 incidents resulted in a total of about 9.01 million personal data records being exposed.

The government is also investigating the possibility of an internal leak in connection with an incident in which information about passengers aboard Air Force One — including President Lee Jae Myung and the first lady — was exposed online ahead of a European trip in June.

President Lee orders creation of cyber security oversight body

Pan-government framework bill has repeatedly stalled in the Assembly

As hacking incidents continued to mount, President Lee Jae Myung ordered the government to draw up pan-government countermeasures. At a Cabinet meeting Tuesday, Lee said hacking attacks exploiting security vulnerabilities have been occurring in rapid succession both at home and abroad, and directed officials to "actively consider establishing a powerful and effective cyber security 'czar' body capable of overseeing and coordinating the scattered security functions."

The absence of a national cyber security control tower has been a consistently raised concern. A framework bill for national cyber security — intended to enable an integrated, whole-of-government response to cyber threats — has been introduced in the National Assembly multiple times over the years but has never been enacted into law. Relevant regulations are currently scattered across several separate statutes, including the Act on Promotion of Information and Communications Network Utilization and Information Protection and the Information Security Industry Act.

Kwon Heon-yeong, a professor in the Department of Information Security at Korea University, said that with state-backed cyberattacks — many originating from China — on the rise and AI making such crimes increasingly commonplace, current police capabilities are likely struggling to keep up. "The national operating framework needs to change so that not just the police, but all national resources — including the National Intelligence Service and the Ministry of National Defense — can be mobilized for an integrated response," Kwon said, adding that legislation enabling joint government management and response is needed.

Park Bo-ra, a research fellow at the Institute for National Security Strategy's future strategy research division, said South Korea's cyber security architecture currently operates on a three-way framework — the National Intelligence Service for government, the Cyber Operations Command for the military, and the Korea Internet & Security Agency for the civilian sector — and that a legal foundation enabling coordinated responses among the three must be established first. "Because hacking groups make no distinction between the public and private sectors, the cyber security framework must also ensure that the private sector, which leads in technology, can participate," Park added.


arin@heraldcorp.com
kido@heraldcorp.com