[2021 National Audit] "No Notification Due to 'Weekend' Despite North Korean Hacking"

Rep. Heo Eun-ah of the People Power Party Points Out Inadequate Cyberattack Response by Government-Funded Research Institutes
Minister Lim Hye-sook of the Ministry of Science and ICT Says "Improvements Including Phone Notifications Starting September"

[Image source=Reuters Yonhap News]

[Asia Economy Reporter Kim Bong-su] Although hacking incidents targeting government-funded research institutions such as the Korea Atomic Energy Research Institute have surged, there have been criticisms that responses were inadequate, with notifications delayed due to weekends.

At the National Assembly’s Science, Technology, Information and Broadcasting Committee’s audit of the Ministry of Science and ICT on the 1st, Heo Eun-ah, a member of the People Power Party, pointed out that the Science and Technology Cybersecurity Center (S&T-SEC) of the Korea Institute of Science and Technology Information (KISTI) recognized hacking attempts but notified the affected institutions belatedly.

According to Rep. Heo, tracing back the North Korean cyber hacking group 'Kimsuky' revealed that the Korea Atomic Energy Research Institute was exposed to attacks for as long as 12 days last April. Additionally, comprehensive hacking attempts have been made targeting current and former members of the National Assembly, pharmaceutical companies, and university professors.

Nevertheless, the Cybersecurity Center’s notifications and responses to the affected institutions were lax. Over the past three years, the center reported 1,488 hacking suspicions, but notifications were only sent via email and text messages, with no phone calls made. In particular, if hacking was detected on weekends, the information was not conveyed to the institutions at all.

Rep. Heo stated, "When I asked the Cybersecurity Center about the failure to notify the Atomic Energy Research Institute of the hacking, they responded that it was because it was Saturday," urging the establishment of supplementary measures. It is known that the Cybersecurity Center only notified the Atomic Energy Research Institute of the hacking incident on the following Monday after the weekend had passed.

Minister Lim Hye-sook of the Ministry of Science and ICT acknowledged these facts and announced that the system has been improved to include phone notifications as well. Minister Lim explained, "We confirmed that there was a problem in the method of notifying cyberattacks," and added, "Starting from September, notifications will also be made by phone."