Ten months of undetected hacking exposes security failures
: A breach affecting about 10,000 officials has raised fears of a broader failure in government cyberdefenses and possible national security risks.

An online training system operated by the Korea National Diplomatic Academy (KNDA) and installed at the Foreign Ministry's headquarters was hacked, exposing the personal information of roughly 10,000 people, including ministry employees, current and former diplomats, staff at overseas missions and government officials stationed abroad. Intelligence authorities are investigating whether the attack was carried out by a state-backed hacking group such as one linked to North Korea.

If the identities of intelligence officers dispatched overseas under diplomatic cover were also compromised, the breach goes far beyond an ordinary leak of personal data. It represents a serious threat to national security. Even before the perpetrators are conclusively identified, the incident should be regarded as a failure of the country's cyberdefenses.

More troubling than the intrusion itself is the fact that it went undetected for 10 months. Hackers are believed to have penetrated the system in April or May of last year and continued accessing Foreign Ministry servers until February, when the National Intelligence Service alerted the ministry. During that period, the ministry remained unaware that its network had been compromised.

The hacked server, despite being located within the ministry headquarters, had been excluded from regular security inspections. The failure to delete personal information belonging to retired diplomats and former government officials returning from overseas assignments likewise reflects a disregard for basic principles of information management.

The Foreign Ministry has explained that the attackers exploited a zero-day vulnerability unknown even to the manufacturer of the security software, making detection difficult. No institution can prevent every cyberattack. Yet agencies entrusted with safeguarding national security should at least possess the ability to detect intrusions early and limit the damage.

The fact that no alarm was raised for 10 months suggests that the security system was, in effect, not functioning.

Cyberspace has already become the front line of military, diplomatic and intelligence competition. North Korea operates state-sponsored hacking organizations and has used cryptocurrency theft to finance its nuclear and missile programs. In such an environment, the identities of diplomats and officials stationed overseas constitute strategic national assets in their own right.

Critical government networks cannot be protected by a security system that merely responds after a breach has occurred. When it comes to safeguarding sensitive information, there is no such thing as excessive preparation.

This incident is not simply a problem confined to the KNDA. It has exposed vulnerabilities in the government's entire information management system. The government must now conduct a comprehensive review of independently operated servers and training systems across all ministries. Controls over access permissions, monitoring systems and the management of former employees' data should be overhauled without delay.

(END)