South Korea is world famous for its flaming fast internet, almost universal broadband coverage and as a leader in digital innovation, hosting global tech brands such as Hyundai, LG and Samsung. But this very successful has made the country a first -class goal for hackers and exhibitions fragile its cyber security defense is back.
The country is rolling from a number of high-profile hacks that disassinate credit card companies, telecommunications, tech startups and state agencies affecting large cuts of the South Korean population. In both cases, the ministry and regulators seemed to be written in parallel and sometimes postponing each other rather than moving unisont.
Critics claim that South Korea’s cyber defense is hindered by a fragmented system of the Ministry of Government and agencies, which often result in slow and coordinated answers, per. Local media reports.
Without any clear government agency that acts as a “first responder” after a cyber attack, the country’s cyber defense is struggling to keep up with its digital ambitions.
“The government’s approach to cyber security remains largely reactive and treats it as a crisis management question rather than as critical infrastructure,” Brian Pak, CEO of Seoul-based Cyber Security Company Theory, told TechCrunch.
Pak, which also serves as an advisor to SK Telecom’s parent company’s special committee for cybersecurity novations, Techcrunch told that because the task of cybersecurity work in silos, to develop digital defense and training of qualified workers are often overlooked.
The country is also facing a serious shortage of qualified cybersecurity experts.
“” “[That’s] Mainly because the current approach has retained workforce development. This lack of talent creates a vicious circle. Without adequate expertise, it is impossible to build and maintain the proactive defesses needed to stay ahead of threats, ”Pak continued.
Political stalemate has filled a habit of seeking quick, obvious “quick corrections” after every crisis, Pak said, all the time, the more challenging, long -term work of building digital resilience continues sidelines.
This year alone, there has been a major cyber security event in South Korea almost every month, which further mounted over the resilience of South Korea’s digital infrastructure.
January 2025
- GS Retail, the operator of grocery stores and grocery markets across South Korea, confirmed a data violation showing the personal information about about 90,000 customers after its web site was attacked between 27 and 4 January. The stolen information includes names, details, adding and e -mail addresses.
February 2025
April and May 2025
- South Korea’s part -time job platform Albamon was hit by a hacking attack on April 30. The violation exposed the resume of more than 20,000 users, including names, phone numbers and email addresses.
- In April, South Korea’s Telecom giant SK Telecom was hit by a major cyberattack. Hackers stole personal data for about 23 million customers – almost half of the country’s population. Much of the wake of Cyberattack lasted through May, where millions of customers we offered a new SIM card after the violation.
June 2025
- YES24, South Korea’s online ticketing and retail platform, was hit by a ransomware -attack on June 9 that knocked its offline services. The disturbance lasted around the oven days with the company back online in mid -June.
July 2025
- In July, the North Korea-Bunded Kimsuky group launched a cyberattack at South Korean organizations, including a defense-related institution, this time using AI-Gened Deepfake images.
- A North Korea-supported hacking group, Kimsuky, used AI-General Deepfake images in a spear-phishing trial against a South Korean military organization, according to Genian Security Center. The group has also targeted other South Korean institutions.
- Seoul Guarantee Insurance (SGI), a Korean financial institution, was hit by a ransomware attack around July 14, disturbing its core system. The incident knocked important services offline, including the issuance and verification of warranty, which left customers in Limbo.
August 2025
- Yes24 was facing another Ransomware attack in August 2025, which took its website and services offline for a few hours.
- Hackers broke into the South Korean financial service company Lotte Card, which issues credit and debit cards, between July 22 and August. The violation exposed around 200 GB of data and is believed to have affected approx. 3 million customers. The violation was not noticed for about 17 days until the company discovered it on August 31st.
- Welcome Financial: In August 2025, Welrix F&I, a lending arm from Welcome Financial Group, was hit by a ransomware attack. A Russian-bound hacking group claimed it stole over a terabbyte of internal files, included sensitive customer data and even leaked samples on the dark web.
- North Korea-connected hackers who are believed to be the Kimsuky group have been spying at foreign embassies in South Korea for months by hiding their attacks as routine diplomatic emails. According to Trellix, the campaign has been active since March and has targeted at least 19 embassies and foreign mini in South Korea.
September 2025
- KT, one of South Korea’s largest telecom operators, has reported a cyber break that exhibits signature data from more than 5,500 customers. The attack was linked to illegal “false base stations” that Tedped into KT’s network, enabling hackers to intercept mobile traffic, steal information such as IMSI, IMEI and phone numbers and even make unauthorized micro -payments.
In light of the recent increase in hacking events, the South Korean Presidential Office’s national security is tightening in tight defense and pressing for a cross-ministerial effort that brings several agencies together in a coordinated, full-government response.
In September 2025, the National Security Office announced that it would implement “understanding” cyber measures through an internal plan, led by the South Korean presidential office. Supervisors also reported on a legal amendment that gave the government’s power to start probes at the first sign of hacking – although companies have not filed a report. Both steps are aiming to tackle the lack of a first Lisnder who has long hindered South Korea’s cyber defense.
But South Korea’s fragmented system leaves responsibility weak and places all authority in a presidential “control tower” could risk “politicization” and overreach, according to Pak.
A better path can be balance: a central body to set strategy and coordinate crises, paired with independent supervision to keep power in check. In a hybrid model, expert agencies like KISA would still handle the technical work – just with more straightforward rules and accountability, Pak told Techcrunch.
When it was reacted to comment, a spokesman for South Korea’s Science Ministry in ICT said the minister with Kisa and other lifting agencies is “obliged to tackle increasingly sophisticated and advanced cyber threats.”
“We continue to work diligently to minimize potential damage to the Korean business and the public,” the spokesman added.
This article was originally published on September 30.