North Korea's Kimsuky steals 1,468 email accounts via impersonation phishing
North Korean hacking group Kimsuky stole the email accounts of 1,468 South Koreans through phishing that impersonated government agencies, media outlets and others. The victims included 57 current and former public officials, foreign affairs and security experts and others. The attacks used 576 relay servers, including 194 in South Korea, and fake portals, and unauthorised access to cryptocurrency exchanges was also attempted.
Key facts
- Affected organisation
- Being confirmed
- Incident type
- Phishing & smishing
- Occurred / detected
- Not confirmed
- Scale of damage
- Email accounts of 1,468 South Koreans
- Cause / method
- Phishing emails impersonating government agencies, media outlets and others, and fake portals
- Location
- South Korea
If your data was exposed
Exposed dataEmail
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
- If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Centre ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗
Timeline
- The theft of 1,468 South Koreans' email accounts and attempted theft of crypto assets by a North Korean hacking group came to light.
- It emerged that Kimsuky had used fake portals and 576 relay servers, and that the victims included 57 current and former public officials, foreign affairs and security experts and others.
5 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.