Audit: 4,778 cyberattack attempts on Korea land ministry, 11 agencies unmonitored
In short
Data obtained by opposition lawmaker Cho In-cheol from the Ministry of Land, Infrastructure and Transport shows 4,778 cyberattack attempts were detected against the ministry and its affiliated agencies between 2021 and 2025. Of 31 affiliated public institutions, 11 — about 35.5% — were not connected to the national security monitoring system as of last month. The figures are detection counts of attempts, not confirmed breaches or data leaks, the reports said.
Read the full story 2 min read
Data obtained from the Ministry of Land, Infrastructure and Transport by Democratic Party lawmaker Cho In-cheol of the National Assembly's Land, Infrastructure and Transport Committee shows that 4,778 cyberattack attempts against the ministry and its affiliated agencies were detected between 2021 and 2025, Yonhap and Asia Economy reported. The yearly totals were 1,021 in 2021, 989 in 2022, 812 in 2023, 1,019 in 2024 and 937 in 2025, or roughly 800 to 1,000 attempts a year, according to Yonhap. The reports described the figures as detections of attack attempts, not as confirmed intrusions or data leaks. [ 2 , 3 ]
By type, website weaknesses such as defacement accounted for 2,609 attempts (54.6%) and simple intrusion attempts for 1,902 (39.8%), together 94.4% of the total, Yonhap reported. Among individual bodies, the ministry itself drew the most attempts at 766, followed by the Korea Real Estate Board (655), Korail (579), the Korea Agency for Infrastructure Technology Advancement (557) and the Korea Expressway Corporation (461). Asia Economy said the targets point to sensitive data tied to daily life, including real estate transaction prices, housing subscription information and the national transport network. [ 2 , 3 ]
Attempts against SR, which was merged into Korail in September, rose from 23 in 2021 to 44 in 2022, 29 in 2023, 97 in 2024 and 175 in 2025 — about 7.6 times the 2021 level, according to Asia Economy and Yonhap. [ 2 , 3 ]
Despite the continued attempts, 11 of the ministry's 31 affiliated public institutions (35.5%) were not connected to the national security monitoring system as of last month, the reports said. The unconnected bodies are the Gadeokdo New Airport Construction Corporation, the Construction Technology Education Institute, the Korea Spatial Information Industry Promotion Institute, the Korea Spatial Information Quality Management Institute, the National Aviation Museum, the Automobile Insurance Promotion Institute, Korail Tourism Development, Korail Logis, Korail Tech, Korea Expressway Corporation Service and the Korea Overseas Infrastructure and Urban Development Support Corporation. According to Asia Economy, these institutions are required to build monitoring centres and link to the national system under the ministry's information security regulations and National Intelligence Service guidelines. Yonhap reported, citing Cho's office, that they have drawn up connection plans but that implementation is being delayed. [ 2 , 3 ]
Cho said the situation should not drag on: “With around 1,000 attacks detected every year, the state of non-connection at affiliated institutions must not be prolonged,” he was quoted as saying, adding that the ministry should closely review budgets, staffing and systems so that facilities the public uses daily have no cybersecurity gaps. Yonhap reported that he also called for support so existing connection plans lead to actual construction. [ 2 , 3 ]
Asia Economy framed the finding against a recent wave of hacking incidents at commercial banks, saying cybersecurity is on heightened alert. The three reports were published within about an hour and a half of each other on the morning of October 6. [ 1 , 2 , 3 ]
Why it matters
The agencies on the list run services and data tied to daily life, including real estate transaction prices, housing subscription information and the national transport network, so lapses in monitoring concern public infrastructure. The finding lands while cybersecurity is already a live concern in South Korea after recent bank hacking incidents, as Asia Economy noted. The documents do not say whether any of the detected attempts succeeded.
Key facts
- 4,778 cyberattack attempts against the land ministry and its affiliated agencies were detected between 2021 and 2025, an average of about 956 a year. [ 1 , 2 , 3 ]
- Annual detected attempts were 1,021 in 2021, 989 in 2022, 812 in 2023, 1,019 in 2024 and 937 in 2025. [ 3 ]
- By type, 2,609 attempts (54.6%) targeted website weaknesses such as defacement and 1,902 (39.8%) were simple intrusion attempts, together 94.4% of the total. [ 2 , 3 ]
- The ministry itself drew the most attempts at 766, followed by the Korea Real Estate Board with 655, Korail with 579, the Korea Agency for Infrastructure Technology Advancement with 557 and the Korea Expressway Corporation with 461. [ 2 , 3 ]
- Attempts on SR, which was merged into Korail in September, rose from 23 in 2021 to 175 in 2025, about 7.6 times more. [ 2 , 3 ]
- As of last month, 11 of 31 affiliated institutions (35.5%) were not linked to the national security monitoring system. [ 2 , 3 ]
- The non-linked institutions are the Gadeokdo New Airport Construction Corporation, the Construction Technology Education Institute, the Korea Spatial Information Industry Promotion Institute, the Korea Spatial Information Quality Management Institute, the National Aviation Museum, the Automobile Insurance Promotion Institute, Korail Tourism Development, Korail Logis, Korail Tech, Korea Expressway Corporation Service and the Korea Overseas Infrastructure and Urban Development Support Corporation. [ 2 , 3 ]
- The figures refer to detected attack attempts, not to actual network breaches or data leaks. [ 2 , 3 ]
Confirmed by several sources
- 4,778 cyberattack attempts against the land ministry and its affiliated agencies were detected between 2021 and 2025. [ 1 , 2 , 3 ]
- Of 31 affiliated institutions, 11 (35.5%) were not connected to the national security monitoring system as of last month. [ 2 , 3 ]
- The reported numbers are detections of attack attempts, not confirmed intrusions or data leaks. [ 2 , 3 ]
- The data came from the land ministry and was analysed by Democratic Party lawmaker Cho In-cheol of the National Assembly's Land, Infrastructure and Transport Committee. [ 2 , 3 ]
Still unclear
- Whether any of the 4,778 detected attempts resulted in an actual breach or data leak. The documents state that the figures are detection counts of attempts and not incidents of intrusion or leaks, without giving a figure for successful breaches.
- Why 11 institutions remain unconnected to the national security monitoring system and when they will be linked. Yonhap reported that the institutions have connection plans but that implementation is delayed, without a date; the documents give no reason for the delay.
- The exact reference date for the non-connection count. Yonhap says the count is as of last month while Asia Economy says as of September; both point to the same period but the documents do not state a precise day.
What local media are saying
Timeline, local time
- Newsis reports 4,778 cyberattack attempts on land and transport systems over five years. [ 1 ]
- Asia Economy reports that 11 of the land ministry's affiliated institutions are not connected to the national security monitoring network, citing data obtained by lawmaker Cho In-cheol. [ 2 ]
- Yonhap reports the annual breakdown, attack types and the list of unconnected institutions from the same data. [ 3 ]