South Korea Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, South Korea
Background readingHacktivismIncident response
Caution
KISA publishes a five-step internet intrusion alert level on its Boho site and raised it from Attention to Caution on 22 October 2026.
Korea Internet & Security Agency (KISA, KrCERT/CC). Source: KISA Boho alert level notices
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
| South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| PIPC fine on Coupang for a breach of about 37.55 million people | KRW 624.6 billion | June 2026 | BleepingComputer (PIPC decision) |
| PIPC fine on KT for the femtocell breach of 16,647 subscribers | KRW 53.979 billion | July 2026 | BleepingComputer (PIPC decision) |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| Lazarus Group | State-aligned | Kaspersky tied a FlashHole campaign against at least three South Korean firms in software, construction and telecom equipment to Lazarus. | BleepingComputer | |
| Gunra | Ransomware | Subject of an August 2026 joint advisory co-authored by South Korean police with US agencies on attacks against government and critical infrastructure. | BleepingComputer |
Laws and rules this year
Full stories
- Amadeus airline data breach Malaysia, Singapore, Japan +3 · 4 Nov 2026
Official statements
- 22 Oct 2026KISA raised the internet intrusion alert level from attention to caution. KISA
- 30 Jul 2026PIPC fined KT KRW 53.979 billion over the femtocell intrusion. BleepingComputer
- 11 Jun 2026PIPC fined Coupang KRW 624.6 billion over the leak of about 37.55 million people's data. BleepingComputer
Incidents
6 of 6 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
| ✅ ConfirmedAsiana Airlines (Amadeus)Via a vendorFull story | 29 Oct 2026 | Transport | Supply chain | None | Confirmed. Asiana said booking-related customer information was exposed through Amadeus and that payment data, held on a separate system, was not affected. | VisaVerge✓ 7 Nov |
 ✅ ConfirmedKorean Air (Amadeus)Via a vendorFull story | 20 Oct 2026 | Transport | Supply chain | None | Confirmed. Korean Air said Amadeus notified it on 20 October that customer data including reservation numbers may have leaked, with no intrusion into its own systems. | VisaVerge✓ 7 Nov |
 ✅ ConfirmedShinhan Bank | 5 Oct 2026 | Finance | Data leak | None | Confirmed. Officials confirmed a data breach at Shinhan Bank, one of several bank incidents that led the Financial Services Commission to hold an emergency meeting and order on-site checks. | BleepingComputer✓ 7 Nov |
 ✅ ConfirmedMinistry of Foreign Affairs (National Diplomatic Academy) | 22 Jul 2026 | Government | Data leak | None | Confirmed. The ministry disclosed that a breach of the academy's online education server, found in February, exposed IDs, names and emails of at least 6,000 people including diplomats abroad. | BleepingComputer✓ 7 Nov |
| ✅ ConfirmedNational Tax Service | 28 Feb 2026 | Government | Not disclosed | None | Confirmed. About $4.8 million in seized crypto tokens was moved out after an NTS press release showed an unredacted wallet recovery phrase; the release was then removed. | BleepingComputer✓ 7 Nov |
 ✅ ConfirmedKyowon Group | 14 Jan 2026 | Education | Ransomware | None | Confirmed. Kyowon confirmed a ransomware attack with an external data leak and reported it to KISA; Korean media put possible exposure at 9.6 million accounts. | BleepingComputer✓ 7 Nov |
FAQ
What is South Korea's national cyber threat level?
Caution, since 22 Oct 2026 · was Attention. KISA publishes a five-step internet intrusion alert level on its Boho site and raised it from Attention to Caution on 22 October 2026.
Which organisations in South Korea confirmed cyber incidents recently?
6 incidents confirmed since January 2026: Asiana Airlines (Amadeus), Korean Air (Amadeus), Shinhan Bank, Ministry of Foreign Affairs (National Diplomatic Academy), National Tax Service and Kyowon Group.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.