Election Committee Server Overload Occurred During Security Inspection, Not Due to External Attack

"The Company Did Not Provide Advance Notice"

Regarding the recent incident in which the Central Election Management Committee's election statistics system server experienced an overload, it has been determined that this was a temporary phenomenon that occurred during a security inspection process, not a cyberattack.

According to the Election Management Committee on April 28, the committee conducted an internal inspection after about three hours of traffic overload occurred on servers related to the election statistics system on the afternoon of April 22.

The photo is unrelated to the article content. October 15, 2024. Photo by Younghan Heo younghan@

At the time, the overload was suspected to be the result of a cyberattack. This suspicion arose because there were indications that someone was repeatedly accessing the homepage in an attempt to overload the server. The committee considered this a serious matter, immediately blocked server access, and requested a police investigation.

Subsequently, during its own security system inspection, the committee discovered that the traffic overload was caused by the automatic inspection method used by a security inspection company. It is known that, on April 21, one day before the overload occurred, the committee had commissioned a security inspection company to check for vulnerabilities in the election statistics system and related systems. This was intended as a precaution against possible attacks on the committee's servers ahead of the presidential election.

Unlike previous inspections, which were conducted manually, the company used an automated inspection method employing an "automation script" for this inspection. It has been reported that the committee was not informed of this change in advance by the company. According to the committee's recent inspection results, the automated inspection initiated by the company caused traffic overload on the committee's servers due to the automation script.

A committee official stated, "Rather than a system problem or external attack, it appears this incident occurred because the inspection company did not inform the committee of the change in inspection method." The official added, "However, since it seems necessary to investigate circumstances beyond what the committee has identified, we do not plan to withdraw our request for a police investigation."