[2026 Parliamentary Audit] North Korean Hacking Groups Target Vulnerabilities in K-Defense

Analysis of data from the office of Rep. Yoo Yongwon, a member of the National Assembly's National Defense Committee
62 data leak incidents involving defense contractors since 2021

Since 2021, there have been 62 cases of defense-related data leaks involving defense contractors and other organizations. Such leaks have been on the rise, particularly since 2024.

According to materials submitted by the Defense Acquisition Program Administration (DAPA) to Yoo Yong-won, a People Power Party lawmaker on the National Assembly’s National Defense Committee, there were eight cases of defense-related data leaks in 2021, three in 2022, and five in 2023. The number rose sharply to 17 in 2024. There were 16 cases last year and 13 through October 1 this year. Of the 62 cases reported since 2021, 46, or 74%, occurred from 2024 onward.

Most of the leaks resulted from cyberattacks rather than the unauthorized removal of materials by employees or former employees. Cyberattacks accounted for 16 of the 17 cases in 2024, 14 of the 16 cases last year, and 11 of the 13 cases this year. In 2023, an employee of the Agency for Defense Development (ADD) also leaked materials, including information on multisensor-based autonomous driving technology for unmanned vehicles. In 2024, a partner company of LIG D&A was hacked, resulting in the leak of jamming technology and technical direction-finding technology. Last year, another partner company of LIG D&A was attacked, and materials on the software (SW) deliverables specification for the military satellite communications system were stolen.

Yoo’s office said there were also two hacking incidents in 2024 and one last year believed to be linked to North Korea, and that file leaks were confirmed in two of those cases. DAPA said, “The incidents could be attributed to North Korea based on the IP addresses and attack methods used in the attempted leaks.” Since 2021, there have been 15 cases in which a data leak was reported but an actual leak could not be confirmed.

DAPA told Yoo’s office that confirmation was difficult for reasons including “losses caused by personnel and the inability to trace incidents because companies did not retain logs related to cyberattacks.” Yoo stressed, “Protecting the country’s core technologies is directly linked to national security. DAPA must strengthen its oversight of defense technology security and establish effective measures to prevent technology leaks before they occur.”

This content was produced with the assistance of AI translation services.