INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Minister Lee Establishes Comprehensive Plan for Cyber Security Attacks

| 2026-10-07 06:42 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
A series of cyberattacks targeting hospitals in South Korea have been reported, with patients' medical videos being circulated on overseas black market sites and hospital computer systems being attacked by ransomware. The attacks led to the interruption of medical services for over 4 hours at one hospital and resulted in the leakage of personal records from another. According to officials, an IP camera is believed to be the source of a leaked video, while video recordings in operating rooms are stored on closed networks using CCTV cameras. Attacks on hospitals have increased this year, with 14 reported incidents compared to 8 last year, resulting in significant disruptions and data breaches. The Ministry of Health and Welfare has acknowledged that medical institutions' cybersecurity levels are inadequate and plans to introduce 'attacking-type cybersecurity' to address the issue.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope healthhealth
Incident Timeline
‎2025/10/07
Threat actors launched 14 cyber attacks on hospitals in 2025, surpassing last year's total of eight.
general_metric 8 attacks
According to the hospital, there were 8 attacks on hospitals last year, but this year there were 14.
general_metric 14 year
According to the hospital, there were 8 attacks on hospitals last year, but this year there were 14.
‎July 7
Threat actors exploited inadequate medical institutions' cybersecurity levels, prompting Minister Jeon Eun-kyung to express concern and halt treatment.
‎2026/10/07
Threat actors successfully launched a cyberattack on medical institutions, resulting in the leakage of patient information and disruption of treatment services.
‎2026/10/07
Threat actors used an internet-connected IP camera to leak patient information, which was then circulated on overseas black market sites.
organisation The Gangwon Daenam Hospital
The Gangwon Daenam Hospital reported that a ransomware attack caused a 4-hour and 50-minute interruption of medical services, while the Hwangson Jeonnam Daenam Hospital reported that 298 personal records were leaked.
data_breach 298 personal records
The Gangwon Daenam Hospital reported that a ransomware attack caused a 4-hour and 50-minute interruption of medical services, while the Hwangson Jeonnam Daenam Hospital reported that 298 personal records were leaked.
organisation The Ministry of Health and Welfare's
The Ministry of Health and Welfare's security support also resulted in a ransomware-related information disclosure and business disruption at Jeonju National University Hospital and Gangneung National University Hospital.
organisation Jeonju National University Hospital
The Ministry of Health and Welfare's security support also resulted in a ransomware-related information disclosure and business disruption at Jeonju National University Hospital and Gangneung National University Hospital.
organisation Gangneung National University Hospital
The Ministry of Health and Welfare's security support also resulted in a ransomware-related information disclosure and business disruption at Jeonju National University Hospital and Gangneung National University Hospital.
organisation the People Power Party
A Korean legislator from the People Power Party pointed out a case in 2021 where a North Korean hacking organization infiltrated Seoul National University Hospital, resulting in the disclosure of health and medical information of approximately eight hundred thirty thousand people.
organisation Seoul National University Hospital
A Korean legislator from the People Power Party pointed out a case in 2021 where a North Korean hacking organization infiltrated Seoul National University Hospital, resulting in the disclosure of health and medical information of approximately eight hundred thirty thousand people.
organisation The Ministry of Health and Welfare
The Ministry of Health and Welfare has pointed out that medical institutions' cybersecurity levels are unable to keep up with the speed of cyberattacks, as they deal with sensitive healthcare information that cannot be easily recovered once leaked.
In particular, the legislator criticized the fact that the national university hospital, which was transferred to the Ministry of Health and Welfare this year, was excluded from the regular security audit.
organisation the national university hospital
In particular, the legislator criticized the fact that the national university hospital, which was transferred to the Ministry of Health and Welfare this year, was excluded from the regular security audit.
organisation Democratic Party
Democratic Party of Korea's representative, Hee Jong-sik, pointed out that medical videos taken at obstetrics and gynecology and plastic surgery departments are being circulated on overseas black market sites.
organisation IP
" A leaked video is believed to have originated from an internet-connected IP camera, according to officials.
organisation CCTV
Currently, video recordings in operating rooms are stored on closed networks using closed-circuit television (CCTV) cameras, rather than internet-connected IP cameras.
organisation The National Health Information Network
The National Health Information Network, which connects all emergency medical institutions nationwide, also experienced 3 incidents this year.
organisation The National Central Medical Center
The National Central Medical Center reported that it took up to 32 hours to recover from the incident.
organisation the National Health Insurance Corporation
The legislator demanded that the national university hospital and the National Health Insurance Corporation, the Korea Health Insurance Review and Assessment Agency, etc. prioritize the introduction of attack-type cyber security.
organisation the Korean Medical Association
He requested that the Korean Medical Association and the Korean Hospital Association propose measures to strengthen self-inspection and security for civilian medical institutions, including attack-type cyber security.
organisation the Korean Hospital Association
He requested that the Korean Medical Association and the Korean Hospital Association propose measures to strengthen self-inspection and security for civilian medical institutions, including attack-type cyber security.
Tactical Metrics
Metrics
data_breach
298
Personal Records
The Gangwon Daenam Hospital reported that a ransomware attack caused a 4-hour and 50-minute interruption of medical services, while the Hwangson Jeonnam Daenam Hospital reported that 298 personal records were leaked.
Intelligence Sources
Chosun Economy 2026-10-07