File-borne breach events · East Asia
South Korea: documented file-borne breach events
Korea's record runs from prosecutor-documented weaponised HWP documents at a nuclear operator to the privacy regulator's recent penalties over malicious files uploaded straight through web upload functions, including a decision issued in August 2026.
Overview
What the record shows
South Korea documents two distinct file-borne patterns, through two different kinds of authority. The older pattern is the targeted email: the December 2014 attack on Korea Hydro and Nuclear Power was investigated by the Seoul Central District Prosecutors' Office, which counted the campaign in thousands of emails carrying malicious code, with the payload in weaponised Hangul Word Processor documents. That format detail matters, because a domestic document format in universal government and enterprise use became the carrier, exploited faster than signature-based controls could describe it.
The newer pattern comes from the Personal Information Protection Commission, and it is the upload rather than the inbox. Its penalty decisions repeatedly describe attackers uploading malicious files through a site's own file upload function and then executing the code inside them, with the commission faulting the absence of file type validation and execution restrictions. Those decisions are recent, name the companies and state the mechanism, which is rarer than it should be.
Korea's largest recent penalties are not on this page. The commission's decisions against several household names record only that an employee device was infected with malware, without stating how, and one major case is documented as voice phishing. This record does not fill those silences in.
Documented events
File-borne incidents in South Korea
Most recent first. Every entry cites the public record it is drawn from.
-
Modetour Network Inc.: Three million records taken after web shell files were uploaded through the site's own upload function
Personal data of about 3.06 million members and non-members was exfiltrated from the travel agency following the June 2024 intrusion. In March 2025 the commission imposed penalties totalling about 757 million won, and found that notification had been made two months late.
The documented vector. Multiple web shell files uploaded through a file upload vulnerability, then executed. The Personal Information Protection Commission's decision records that the attacker exploited a file upload vulnerability to upload multiple web shell files, and executed the malicious code present in those files. The commission found neither file extension validation nor restrictions on execution permissions were in place.
Note on this entry
The record documents a server side intrusion through the site's own upload function. It is carried here because it shows how directly an upload path reaches a database, and because the commission's finding on file validation is worth reading. No prevention analysis is published for it.
- travel
-
HD Korea Shipbuilding & Offshore Engineering and HD Hyundai Construction Equipment: Web shell uploaded through a mobile device management server exposed employee records
Names and employee identifiers of 9,503 employees and partner staff were exposed following the March 2024 intrusion at the two group companies. The commission issued its decision on 26 August 2026, imposing penalties totalling about 78 million won.
The documented vector. Web shell file uploaded by exploiting a vulnerability in a mobile device management server. The Personal Information Protection Commission's decision records that the attacker uploaded a web shell file by exploiting a vulnerability in the mobile device management server, and then moved laterally. The commission penalised the file upload safeguard failure alongside the absence of network segmentation.
Note on this entry
As with the other upload case on this record, the intrusion ran server side through a management interface. It is carried here for that pattern. No prevention analysis is published for it.
- manufacturing
Source: Personal Information Protection Commission · Source: Seoul Economic Daily
-
Interpark: Over 10 million customers' data stolen after one tailored malware attachment was opened
Attackers intruded into the online retailer Interpark in May 2016; the breach was discovered on 11 July 2016 after a 3 billion won bitcoin extortion demand. Personal data of more than 10 million customers, around 26.6 million data items including identifiers, phone numbers and addresses, was stolen. The ICT Ministry and the Korea Communications Commission published investigation findings, and the National Police Agency attributed the operation to North Korea's Reconnaissance General Bureau.
The documented vector. Malware attachment on a spear-phishing email crafted to match a targeted employee's routine correspondence. Attackers studied a specific Interpark employee's email patterns and delivered malware in an attachment styled as routine correspondence. The published investigation account states that once the employee opened the malware attachment, the infection spread through Interpark's networked computers.
How this class of vector is removed
This class of vector, a malware attachment tailored to look like routine correspondence, is addressed precisely because the control does not judge the lure: an attachment in a supported document format is rebuilt to its known good specification and stripped of active content however convincing the surrounding email is. The published account does not name the file type, so this entry maps the class of vector rather than a specific file.
Content Disarm and ReconstructionEmail CDR RelayGlasswall Halo / Glasswall Meteor / Glasswall Genesis
- retail
-
Korea Hydro & Nuclear Power Co.: Nuclear operator hit by thousands of spear-phishing emails carrying weaponised HWP documents
Attackers targeted Korea Hydro and Nuclear Power with a mass spear-phishing wave in December 2014, then leaked reactor blueprints, manuals and personal data of about 10,000 employees online alongside threats against the plants. The prosecutors' joint investigation concluded in March 2015 that the malicious code matched the Kimsuky malware family attributed to North Korea.
The documented vector. Hangul Word Processor (HWP) documents exploiting a parser vulnerability to drop a disk-wiping payload. Between 9 and 12 December 2014, attackers sent 5,986 phishing emails containing malicious code to 3,571 KHNP employees, figures published by the Seoul Central District Prosecutors' Office joint investigation. Contemporaneous technical analysis documents the carrier as HWP documents exploiting a Hangul Word Processor vulnerability and delivering a master boot record wiper.
How this class of vector is removed
This class of vector, a document weaponised against its own parser, is what deterministic rebuild addresses where the format is supported: the file is reconstructed to the format's known good specification, so a document built to trigger a parser flaw does not survive the rebuild intact, and no prior signature for the exploit is needed. That qualification carries weight here, because the carrier was a domestic Korean office format rather than an international one, Either outcome keeps the weaponised file away from the parser it was built to attack.
Content Disarm and ReconstructionEmail CDR RelayGlasswall Halo / Glasswall Meteor / Glasswall Genesis
- energy
Scope
How to read this page
Every event on this page meets three tests before it is published. It is documented by reliable public sources: a regulator, an official inquiry, the affected organisation's own disclosure, or reputable press with named confirmation, and each entry links to those sources. The initial access or payload delivery travelled as a file, as the public record states it. And where an entry carries a prevention analysis, that analysis is bounded by what we can evidence; where an entry carries none, that is deliberate.
About the organisations named here. They are named because the public record names them, and for no other reason. Nothing on this page alleges fault, negligence or any breach of duty by any organisation or individual, and nothing here should be read as saying that anyone acted improperly or that their security arrangements were inadequate. Being attacked is not evidence of either, and the organisations on this page include some of the most heavily defended in the region. We summarise what published sources report and link to them so you can read them yourself. We have not independently investigated any incident and we hold no non-public information about any of them. Names are used to identify the organisations concerned; no affiliation with them, and no endorsement by them, is implied, and all trade marks remain their owners'.
About the prevention analysis. Where an entry describes how a class of vector is addressed, that is a general statement about how a control treats that class of content. It is not a claim that our products were in use, that they would have been deployed in that architecture, or that they would have prevented that incident. It is not an assessment of any organisation's actual controls, which we do not know. What a control achieves in practice depends on configuration, deployment and file type. Where an entry carries no prevention analysis, we are making no claim about that event either way.
Generally. This page is a working reference, not an incident report, a security assessment or legal advice, and it is provided without warranty. Details reflect the public record on the review date and may have changed since. If you believe anything here is inaccurate, incomplete or out of date, tell us and we will review it promptly and correct it where the record supports that.
Elsewhere in the region