GBNKCenter

lazarus.day

In late 2018, a Gyeongbuk Hana Center employee’s PC in South Korea was infected through a malicious email, exposing files containing personal information for 997 North Korean defectors. The leaked data included names, birth dates, and addresses, while contact numbers and resident registration numbers were reportedly not in the affected files. Authorities confirmed the breach after a field investigation on December 19, referred the case to police, notified victims, and conducted emergency checks across Hana Centers; the incident also exposed failures to password-protect and store defector data on systems separated from the internet.

CSIS Significant Cyber Incidents

North Korean hackers stole the personal information of almost 1,000 North Korean defectors living in South Korea

CFR Cyber Operations Tracker

The personal information of nearly one thousand North Koreans who defected to South Korea was leaked after unknown hackers gained access to the database of South Korea’s resettlement agency.

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

Reported: 2018-12; Victims: GBNKCenter; Motivations: DataBreach Espionage; Sectors: Government; Countries: Korea, Republic of

North Korean hackers stole the personal information of almost 1,000 North Korean defectors living in South Korea