TIME SINCE MOST RECENT KOREAN CYBERSECURITY FAILURE
South Korean President's office staff
Presumed North Korean hackers breached personal emails of a staff member in President Yoon Suk Yeol's office. The incident highlights ongoing espionage risks to government communications. Response included enhanced security measures.
South Korean organizations
North Korean-linked Kimsuky group used GitHub as command-and-control in multi-stage phishing attacks against South Korean organizations. Campaigns involved decoy PDFs, PowerShell scripts for profiling and data exfiltration to GitHub repos. This reflects living-off-the-land techniques for persistence.
Axios software (impacting South Korean infrastructure)
North Korea-linked UNC1069 group breached Axios open-source software via a malicious update released early this week, aiming to steal login details. The software underpins much of the internet's infrastructure, potentially affecting South Korean services. Malicious code was removed after detection.
Multiple ISMS-P Certified Companies (Under Armour Korea, Lotte Card, Coupang)
Statistics released by the Personal Information Protection Commission (PIPC) on March 13, 2026, revealed that 27 out of 263 ISMS-P certified companies have suffered a total of 33 major data leaks over the past five years. The crisis was triggered by high-profile breaches at organizations that had recently received state cybersecurity certification, including Under Armour Korea and Lotte Card (which suffered a breach just 48 hours after receiving certification).
Virtual Wallets (Korean Phishing Gang)
Seoul Police arrested 7 members of a phishing gang that stole 800 million won from virtual wallets. The arrests occurred around March 4, 2026. This highlights ongoing phishing threats in South Korea's crypto sector.
NR Capital
Cybersecurity intelligence identified a high-priority 'Total Disclosure' listing of NR Capital's full data on secondary marketplaces following the March 4, 2026 takedown of LeakBase forum. The exfiltrated dataset suggests a complete server-side export of sensitive financial data. This breach heightens risks for phishing and credential stuffing in South Korea's financial sector.