N. Korean hackers steal data from National Court Administration

The data stolen from South Korea’s national court administration network by Lazarus, a hacker group under North Korea's Reconnaissance General Bureau, exceeded 1TB (terabyte), equivalent to 2.6 billion pages of documents, including personal information. Only 0.5% of the leaked data was successfully restored, which contained much information such as financial information and medical certificates. The theft is estimated to have a great impact as the remaining 99.5% that was not restored is likely to contain industrial technology or personal information of North Korean defectors.

The National Investigation Headquarters of the National Police Agency announced on Sunday that a total of 1,014 GB (gigabytes) of data was found to have been leaked by Lazarus from the National Court Administration's computer network from June 2021 to January 2023. This is equivalent to approximately 2.62 billion sheets of A4 paper (based on 2,000 characters per sheet). The stolen data was sent to a total of eight servers, including four domestic servers and four overseas servers.

The police managed to restore 4.7GB (0.5%) of the data, confirm‎ing that 5,171 documents related to personal debt recovery had been leaked, including personal information such as resident registration numbers, medical certificates, handwritten statements, debt data, and marriage certificates. In March, the Supreme Court apologized for the data leak, saying, “Twenty-six PDF files containing personal information had been leaked,” meaning that the leak's impact has increased by at least 200 times.

The problem is that it is difficult to verify what was contained in the 1009GB of leaked data that was not restored. This is because the National Court Administration commissioned an investigation of the malicious program to the National Police Agency and the National Intelligence Service in December 2023, despite the discovery of the program in February of the same year. Over this period, the leaked data were deleted due to data expiry requirements. There is a risk that industrial and defense technology stored by the patent court or the personal information of sexual assault victims submitted as evidence in criminal proceedings has been leaked. The police provided 5,171 files confirmed to have been leaked to the National Court Administration on May 9 and advised to notify the victims to prevent further damage.


이상환기자 payback@donga.com