Government systems including Interior Ministry's Onnara system hacked
Suspicions were raised of hacking, believed to be the work of North Korea, targeting the Ministry of the Interior and Safety, the Ministry of Foreign Affairs and the Defense Counterintelligence Command. On 17 October 2025, the government confirmed traces of hacking in systems including the Onnara system.
Key facts
- Affected organisation
- Ministry of the Interior and Safety
- Incident type
- Hacking & intrusion
- Occurred / detected
- Not confirmed
- Scale of damage
- Not confirmed
- Cause / method
- Hacking believed to be the work of North Korea
- Location
- South Korea
Timeline
- Suspicions were raised of suspected North Korean hacking targeting the Ministry of the Interior and Safety, the Ministry of Foreign Affairs and the Defense Counterintelligence Command.
- The government confirmed traces of hacking in systems including the Ministry of the Interior and Safety's Onnara system.
12 related reports
- [단독] 대한민국 정부가 털렸다... 행안부·외교부·방첩사, 북한 추정 해킹에 국가안보 ‘비상’
- ‘온나라시스템’ 해킹 의혹 두 달째, 정부는 침묵 일관···“이러면 은폐 의혹 못 피해”
- “정부 업무망 3년 해킹 당해” 두달 만에 실토…피해 내용도 모른다
- 해킹 의혹 사실이었다…정부 “온나라 시스템 해킹 흔적 확인”
- 정부 내부 전산망 ‘온나라시스템’도 해킹 노출…행안부 “조사 중”
- [대한민국 털렸다] ‘프랙’ 보고서 사실이었다...행안부 온나라 시스템 등 해킹 확인
- 공무원 업무망 '온나라시스템' 해킹...정부 3년동안 몰랐다
- 국정원 “미상 해커, 3년간 정부 행정망 해킹…인증서·IP로 침투”
- 정부 행정망 3년간 털렸다…공무원 전자인증서 해킹당해
- 정보보호 전문가 “정부 업무망 3년간 해킹…드러난 피해는 빙산의 일각”
- 온나라시스템 해킹…정부 “관리 부주의 가능성, 인증체계 전환 추진”
- [사설] 국가 행정망에 해킹범 들락거려도 3년간 몰랐다니
Other incidents at Ministry of the Interior and Safety
Resident registration numbers and medical certificates exposed in public bodies’ disclosure portal documents
35Impact: Personal and sensitive information exposed in attachments to 35 documents from at least 22 public bodies
Personal and sensitive information, including resident registration numbers, passport numbers and cancer diagnosis certificates relating to public officials and private individuals, was exposed in attachments to 35 documents from at least 22 public bodies published on the Information Disclosure Portal. The causes were identified as omissions in the non-disclosure and masking settings applied by the bodies that produced the documents, alongside limitations in filtering unstructured files. The Ministry of the Interior and Safety suspended downloads of original documents on 5 November and began a comprehensive inspection of public bodies, with an investigation into the extent of the exposure still under way on 9 November.
Related reports: 12 · last report →Government24 hack exposes memory dump files from 11 servers
Impact: Memory dump files stolen from 11 servers; an estimated 36 resident registration numbers, three telephone numbers and 55 IDs and passwords exposed
A cyber-attack targeting a vulnerable page on Government24’s children’s portal on 17 August led to the theft of memory dump files from 11 servers. The Ministry of the Interior and Safety estimated that 36 resident registration numbers, three telephone numbers and 55 IDs and passwords may have been exposed, but could not identify the victims or the precise extent of the leak because the attacker erased traces of the intrusion. The incident notice was hidden after 30 days and deleted following media coverage.
Related reports: 5 · last report →Cyber-attack blocks Interior Ministry relay server, disrupting property app
Impact: Service outage at a property transaction price app
A cyber-attack caused a relay server of the Ministry of the Interior and Safety to be temporarily blocked. As a result, a property transaction price app suffered a service outage.
Read on Chosunbiz ↗Government24 user's change-of-address form exposed on Google search for over 3 days
1Impact: Address, mobile phone number and first part of the resident registration number of one Government24 user
The change-of-address form of one Government24 user was publicly accessible through Google search for at least three days. The user's address, mobile phone number and the first part of the resident registration number were exposed. The search results have been removed, and the exact cause of the exposure is being investigated.
Read on 뉴스1 ↗Government24 source code error leaks personal data of 1,233 people
1.2kImpact: Personal data of 1,233 people
In early April 2024, a source code error related to civil documents and tax payment certificates on Government24 leaked the personal data of 1,233 people. An investigation by the Personal Information Protection Commission (PIPC) found missing tests and unaddressed vulnerabilities, amongst other issues. The PIPC imposed penalties including a fine of 273 million won on the Ministry of the Interior and Safety.
Related reports: 40 · last report →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.