Court Computer Network Hacked... 1014GB Leaked to Bukhan

A joint investigation has revealed that over 1000GB of data was leaked from the court's internal computer network over a period of two years. Furthermore, criticism is mounting over the Supreme Court's inadequate response, which resulted in only 0.5% of the leaked data's damage being identified.

On the 11th, the National Police Agency's National Investigation Headquarters announced that, following a joint investigation with the National Intelligence Service and the Prosecutor's Office into the 'court computer network hacking and data leak' case, it was confirmed that court data had been leaked to North Korea.

Dark clouds hang over the Seoul Seodaemun-gu Police Agency building on the 15th, ahead of the announcement of the "Police System Improvement Plan," which includes the establishment of the Police Bureau, a police work organization, and the enactment of command regulations by the Minister of the Ministry of the Interior and Safety over the Commissioner of the National Police Agency. Photo by Kang Jin-hyung aymsdream@

According to the police investigation, North Korea transmitted 1014GB of court data outside the court's computer network from before January 7, 2021, until February 9 of last year. The police discovered 5,171 files (4.7GB) related to rehabilitation cases outside the court network, confirming the leak.

The attacker had been inside the court's computer network since before January 7, 2021; however, detailed records from the security equipment at that time had already been deleted, making it impossible to determine the exact time and cause of the initial intrusion.

Nevertheless, the police found that the attacker's malicious program transmitted a total of 1014GB of data over two years to four domestic servers and four overseas servers until it was detected by antivirus software. They traced this activity to confirm some of the leaked data.

The 4.7GB of confirmed leaked data consisted entirely of 5,171 documents related to personal rehabilitation cases in the court, including handwritten statements containing personal information, debt increase and insolvency reports, marriage certificates, and medical certificates. The court plans to notify the victims individually about the damage.

The National Police Agency, National Intelligence Service, and Prosecutor's Office conducted a comprehensive comparison and analysis of the malicious program used in this case, server payment records (virtual assets), and IP addresses with previously identified North Korean hacking incidents, concluding that this case was the work of a North Korean hacking organization.

This conclusion was drawn because the same malicious program previously announced by the police, the Korea Internet & Security Agency, and related organizations as originating from North Korea was found in this case. Additionally, 12 command and control servers were identified, which had been confirmed in previous North Korean-related incidents.

The police provided the 5,171 leaked files to the Court Administration Office to notify victims whose personal information was leaked and to prevent secondary damage. Furthermore, they plan to track the virtual assets used as operational funds by the hacking organization through cooperation with domestic and international related agencies in the future.