Article
What is Data Leak and How Can Data Leaks Be Prevented?
A data leak is the unauthorized sharing of sensitive information. Learn the causes, how it differs from a data breach and how to prevent…
Read more
Significant cyber incident
KHNP nuclear operator hack and data leak, 2014
In December 2014 data from Korea Hydro & Nuclear Power Co.
In short
In December 2014 data from Korea Hydro & Nuclear Power Co. (KHNP), the state-run operator of all 23 South Korean nuclear reactors, was posted online by a Twitter account. KHNP and the government said only non-critical data was lost and reactor safety was not at risk. In March 2015 prosecutors attributed the leaks to an unidentified North Korean hacker group that used phishing emails to take data from staff mailboxes.
What happened
On 22 December 2014 KHNP and the South Korean government said the operator’s computer systems had been hacked. They said only non-critical data had been lost and that the safety of the 23 reactors was not at risk. In the week before, a Twitter account had been used to publish information about the reactors. The poster described himself as chairman of an anti-nuclear group based in Hawaii, threatened more leaks unless three aging reactors were shut down by Thursday, and asked for money. Officials said they could not verify the messages.
On 28 December KHNP’s chief executive said attacks on the company’s headquarters administration were still continuing, while the closed network used for reactor operations could not be reached from outside lines. Emergency teams stayed on stand-by to the end of the year. According to Yonhap, the poster published data five times in December 2014.
On 17 March 2015 prosecutors announced interim results. They said the series of incidents was believed to be the work of an unidentified North Korean hacker group. About 94 files had been released in six postings, including staff address books, and prosecutors described them as mostly general training material. A further posting on 12 March 2015 asked for money. North Korea denied involvement.
Timeline
-
July to September 2014
Phishing mainly takes place; the attacker takes data from the email of partner-company staff and of current and former KHNP staff.
-
9 December 2014
Malware emails are sent to 3,571 KHNP employees; eight computers are infected and five hard disks are reset. Reuters gives the attack window as 9 to 12 December.
-
The week before 22 December 2014
A Twitter account is used to publish reactor information; the poster threatens more leaks unless three reactors are shut down by Thursday.
-
22 December 2014
KHNP and the government say the systems were hacked, only non-critical data was lost and reactor safety is not at risk.
-
28 December 2014
KHNP's chief executive says attacks on headquarters administration continue; reactor networks are closed to outside lines.
-
12 March 2015
A sixth posting is made, asking for money; Yonhap reports the IP address used was in Vladivostok, Russia.
-
17 March 2015
Prosecutors announce interim results naming a North Korean hacker group; North Korea's Uriminzokkiri website calls the claim nonsense.
-
17 March 2015
The government says it will set up a special cyber defense team.
-
12 May 2016
A US House bill is introduced whose findings refer to South Korea's March 2015 accusation against North Korea.
How the attack worked
The account comes from the Korean investigation team’s interim results as reported by Yonhap and Reuters. No full technical report was opened, so the detail below is limited to what the prosecutors said.
Getting passwords
The attacker sent 88 emails to current and former KHNP staff. Clicking them showed a fake password-change window, and typed passwords were captured (Phishing, T1566). Mainly in July to September 2014, phishing also reached staff of KHNP partner companies.
Taking the data
With the stolen passwords the attacker opened staff mailboxes and online communities and took files (Valid Accounts, T1078). The prosecutors said the data was taken this way and not by entering the KHNP network directly. The reactor control network was described by KHNP as closed to outside lines.
Malware emails in December
On 9 December 2014 emails with malicious code went to 3,571 employees. Prosecutors reported eight infected computers and five reset hard disks, but found no data leak from this wave. They said the code was close to the so-called kimsuky code used by North Korean hackers.
Hiding the source
The attacker used IP addresses from a domestic VPN service to block tracing. Sources differ on where addresses pointed: Reuters reported a Chinese city near North Korea, Yonhap reported addresses based in North Korea, and the Korean report of the same briefing mentions an earlier address in Shenyang, China, and a last posting from Vladivostok, Russia.
Pressure and leaks
Files were published on social media in six postings and used to demand reactor shutdowns and, later, money.
- Phish staffEmails with a fake password-change window were sent to current and former KHNP staff and partner firmsTechnique T1566 (MITRE ATT&CK, opens in a new tab)
- Capture passwordsTyped passwords were collected through the fake window
- Open mailboxesThe stolen passwords were used to enter email boxes and online communitiesTechnique T1078 (MITRE ATT&CK, opens in a new tab)
- Take filesTraining documents, address books and some plant drawings were taken, not from the KHNP network directly
- Hide the trailTraffic ran through a VPN service to block IP tracing
- Publish and demandFiles were posted in six postings with demands for shutdowns and then money
ATT&CK techniques
- Technique Phishing (T1566): ATT&CK Technique Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password. T1566 · Initial Access
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Who says who was behind it
Who attributed it, and how firm it is
Attributed by the South Korean prosecutors' joint investigation team, 17 March 2015, to an unidentified group of North Korean hackers aiming at social unrest. The basis given was malicious code close to the so-called kimsuky code used by North Korean hackers, and IP traces. No named group profile is used on this page. North Korea denied involvement.
Sources differ on the IP traces: Reuters, 28 December 2014 and 17 March 2015, reports addresses traced to a Chinese city near North Korea; Yonhap, 17 March 2015, reports multiple addresses based in North Korea. A US House bill (12 May 2016) says South Korea described the aim as causing a malfunction at the reactors, while the prosecutors' own wording was social unrest.
No attribution was made on 22 December 2014; KHNP and the minister did not mention North Korea then.
Impact
KHNP and the government said only non-critical data was lost and reactors were not at risk. Prosecutors said 94 files were posted in six postings, including staff address books and phone lists, and mostly general-use training documents. Reactor drawings were among the posted material according to Yonhap. No reactor shutdown or control-system compromise has been reported in the sources opened. Sources differ in tone: officials called reactor control "totally independent and closed", while experts quoted by VOA voiced alarm that controls could be at risk. KHNP and the government kept emergency teams on stand-by to the end of 2014.
Government and regulator response
- 22 December 2014: KHNP and the government said only non-critical data was lost and reactors were safe.
- Late December 2014: KHNP and the government ran emergency teams on stand-by to the end of the year; prosecutors asked China for help with address traces (Reuters, 28 December 2014; 17 March 2015).
- 17 March 2015: the joint investigation team gave interim results and said it would work with the United States and China. It advised avoiding private email for work, changing passwords often and separating networks.
- 17 March 2015: the government said it would set up a special cyber defense team.
Lessons
-
Staff email is a way in
The data came from mailboxes and online communities of staff and partner firms, not from the reactor network.
-
Partners count
Much of the data was taken by hacking the email of staff of partner companies.
-
Passwords are the prize
A fake password-change window was used to capture passwords that then opened mailboxes.
-
Separate networks help
KHNP said the closed reactor network could not be reached from outside lines, which limited the harm.
-
Claims need checking
Officials could not verify the first posts at once; later findings changed the picture, so check before saying what is safe.
What to check in your own organization
-
Phishing resistance
Test whether staff can spot a fake password-change page, and add multi-factor authentication to email.
-
Partner access
List partner and contractor staff with copies of your data and check how their email is protected.
-
Plant data in mail
Search mailboxes and shared drives for drawings, manuals and address lists that should not sit there.
-
Personal email
Check whether staff use private email for work, as the investigators advised against.
-
Network separation
Confirm that operational networks cannot be reached from corporate IT or the internet.
-
Response drill
Practise a threat posted on social media with a deadline, including who checks claims and who speaks.
-
Mailbox monitoring
Alert on logins to mailboxes from VPN services or unusual regions.
Where it happened
- Industry Energy and utilities Exposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.
- Country South Korea South Korea faces cyber espionage and destructive attacks linked by official sources to North Korean state groups, and large data breaches at telecom and retail firms. Asia Pacific
Questions
Were the reactors affected?
KHNP and the government said no; only non-critical data was lost and the reactor network was closed to outside lines. No reactor shutdown has been reported in the sources opened.
Who was behind it?
Prosecutors said on 17 March 2015 it was believed to be an unidentified North Korean hacker group. North Korea denied involvement. Sources differ on the IP traces: Reuters says a Chinese city, Yonhap says North Korea.
What was leaked?
Prosecutors said 94 files in six postings, including staff address books and mostly general training material. Reactor drawings were also posted, according to Yonhap coverage.
How was the data taken?
Prosecutors said through phishing of staff and partner mailboxes, not by entering the KHNP network directly.
What did the hacker want?
The poster demanded that three reactors be shut down, then asked for money and claimed other countries had offered to buy the data.
Sources
- South Korea Nuclear Plant Was Hacked, Operator Says NBC News (Reuters), 22 December 2014
- South Korea Nuclear Plant Operator Hacked VOA News, 22 December 2014
- S Korea cyber attacks continuing Reuters via IOL, 28 December 2014
- South Korea blames North Korea for December hack on nuclear operator Reuters via Business Insurance, 17 March 2015
- N. Korea behind nuke power plant data leakage: investigators Yonhap via The Korea Times, 17 March 2015
- 원전도면 유출 북한 해커조직 소행… "사회혼란 목적" Yonhap via Seoul Shinmun, 17 March 2015
- North Korea State Sponsor of Terrorism Designation Act of 2016 (H.R. 5208, introduced) US House of Representatives, GovInfo, 12 May 2016
- Phishing, Technique T1566 - Enterprise MITRE ATT&CK
- Valid Accounts, Technique T1078 - Enterprise MITRE ATT&CK
- #StopRansomware Guide CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.