Yang Jeongsuk: "SMEs Unprepared for Cyber Threats... Account for 90% of Hacking Damage"

[Asia Economy Reporter Joselgina] It has been pointed out that measures are urgently needed as damages to small and medium-sized enterprises (SMEs) are increasing due to cyber threats such as hacking.

According to data submitted by the Korea Internet & Security Agency to Yang Jeong-suk, an independent member of the National Assembly's Science, Technology, Information and Broadcasting Communications Committee, there were 1,383 cases of private companies suffering damage from hacking over the past three years from 2019 to the end of July 2021, of which 1,246 cases, accounting for more than 90%, involved SMEs.

By year, there were ▲418 cases in 2019, ▲603 cases in 2020, and ▲362 cases as of the end of July 2021. The monthly averages were ▲34 cases in 2019, ▲50 cases in 2020, and ▲51 cases as of the end of July 2021. If calculated on a monthly average basis through the end of the year, it is expected that more than 600 cases will occur this year.

During the same period, by company size, ▲SMEs accounted for 1,246 cases, making up 90% of the total. This was followed by ▲non-profit organizations with 95 cases (7%) and ▲large corporations with 42 cases (3%).

For this year, ▲SMEs had 338 cases (93%), ▲non-profit organizations 15 cases (7%), and ▲large corporations 9 cases (2%). Compared to the previous year, cases involving large corporations and non-profit organizations decreased, but those involving SMEs actually increased.

By type of hacking during the same period, ▲system hacking was the most frequent with 614 cases, accounting for 44% of the total. This was followed by ▲DDoS with 1,246 cases (33%) and ▲malware infection and distribution with 304 cases (22%). This year, ▲system hacking accounted for 160 cases (44%), ▲malware infection and distribution 105 cases (29%), and ▲DDoS 97 cases (27%), confirming that malware infection and distribution cases outnumbered DDoS cases.

However, the actual arrest rate for cyber threats is low. Based on data submitted by the National Police Agency to the lawmaker's office, an analysis of cyber threat incidents from 2019 to the end of July 2021 shows that out of 9,653 cyber threat occurrences, only 2,262 cases were actually apprehended, resulting in an arrest rate of 23%.

By year, ▲3,638 cases occurred in 2019, with 1,007 cases (28%) apprehended. ▲In 2020, out of 4,344 cases, 911 cases (21%) were apprehended, and ▲in 2021, out of 1,671 cases, 344 cases (20.6%) were apprehended, showing a decreasing trend in the number of arrests each year. Looking at this year's cyber threat arrests by type, there were ▲176 arrests out of 1,181 hacking cases (15%), ▲36 out of 76 malware cases (45%), ▲3 out of 7 DDoS cases (43%), and ▲131 out of 407 other cases (32%).

Lawmaker Yang Jeong-suk stated, “While damages to large corporations and non-profit organizations from cyber threats are decreasing, damages to SMEs are actually increasing,” and pointed out, “This year, as ‘malware infection and distribution’ cases have surpassed ‘DDoS’ cases, appropriate countermeasures are necessary.”

Yang emphasized, “The arrest rate for cyber threats is on a declining trend. Although hacking occurs most frequently, the arrest rate is remarkably low, raising concerns about cyber hacking damages to private companies,” and added, “It is necessary to provide a safe environment where private companies can smoothly respond to hacking and DDoS attacks through analysis of the causes of cyber threats.”