Seoul’s Premier Hospital Falls Victim to North Korean Hackers, Losing 830K Data

According to the Korean National Police Agency (KNPA), Seoul National University Hospital (SNUH) fell victim to a cyberattack orchestrated by North Korean hackers.

Law enforcement has been diligently investigating the case, and based on various pieces of evidence, they have attributed the attack to North Korean threat actors. Intrusion techniques, IP addresses linked to North Korea, website registration details, and linguistic patterns utilized in the attacks all contributed to the conclusion reached by authorities.

Speculations point to the Kimsuky hacking organization as the potential culprits behind the incident, according to South Korean media. However, the police report refrains from naming any specific threat actors involved. The attack on the hospital’s internal network originated from seven servers located in South Korea and other countries.

Authorities have disclosed that a staggering 831,000 individuals had their personal information compromised as a result of the incident, with the majority being patients. Among the affected individuals, approximately 17,000 are either current or former employees of various hospitals.

In a news release, the Korean National Police Agency (KNPA) issued a warning stating that North Korean hackers could potentially target critical infrastructure across multiple sectors. The importance of implementing robust security measures such as regular patching, stringent user access management, and data encryption was strongly emphasized.

The Korean National Police Agency (KNPA) has issued a warning about safeguarding South Korea’s cyber infrastructure against state-backed cyber-attacks by enhancing information sharing and collaboration with relevant authorities. North Korean hackers have been linked to previous attacks on hospital networks to steal patient information and demand ransom payments.

The United States has urged the healthcare industry to strengthen defenses against North Korean threats, citing the Maui ransomware threat. Kaspersky researchers identified a subset of the Lazarus gang, Andariel or Stonefly, responsible for the Maui ransomware campaign. These developments highlight the importance of increased cybersecurity measures to mitigate the risks posed by state-sponsored hacking groups.