‘China hacked S. Korean foreign ministry emails last year’

It was confirmed Wednesday that South Korea's foreign affairs ministry was hacked by Chinese authorities in January last year during the Moon Jae-in administration, resulting in the leak of 4.5 gigabytes (GB) of emails. Chinese authorities were also found to have infiltrated the computer network of the Presidential Office, leaking documents related to the national defense ministry.

According to government sources on Wednesday, South Korea’s National Intelligence Service identified China's Ministry of State Security (MSS), the Chinese equivalent of the South Korean NIS, as the epicenter of the hacking attack. This means that South Korean intelligence officials have concrete evidence that the MSS, which is part of the State Council and the home of Chinese espionage, attempted to hack into the South Korean government and the president's office. This is the first time the MSS has been identified as a hacking entity against the South Korean government. The incumbent South Korean presidential office has reportedly confirmed the findings.

"We understand that around April last year, about a month after the inauguration of the new South Korean government, an ally country transmitted through South Korean intelligence channels specific intelligence on Chinese hacking clues against the South Korean foreign affairs ministry, including the hackers and the timing of their activities," a government source told The Dong-A Ilbo Wednesday. The Yoon Suk Yeol government then launched a detailed verification effort. It has been confirmed that the circumstantial evidence included activities of hacking defense information through the Presidential Office’s computer network.

The NIS received the hacking tip in January last year and started an investigation to confirm‎ that the Chinese Ministry of State Security had exploited a vulnerability in spam-blocking equipment to leak 4.5 Gigabytes of emails. It also reportedly confirmed circumstantial evidence of an attempt to infiltrate the Presidential Office’s computer network.

At the time, the South Korean NIS and the foreign affairs ministry did not publicly disclose the hacking attack, which was investigated to reveal the involvement of China's Ministry of State Security. "In January last year, 4 Gigabytes of data stored in the ministry's spam blocking system was leaked externally in a hack whose attack route has not been confirmed," the foreign affairs ministry said in response to The Dong-A Ilbo’s request for confirmation. "The leaked data did not contain any secrets." The NIS said it "could not confirm‎" the report.


Kwan-Seok Jang jks@donga.com