Seoul National University Hospital

Seoul National University Hospital (SNUH) is a major healthcare institution located in South Korea. In May 2021, the hospital experienced a significant cybersecurity incident where North Korean hackers breached its network. The attackers stole sensitive medical and personal data, impacting approximately 831,000 patients and 17,000 current and former employees. The intrusion involved seven servers hosted across multiple countries, facilitating the infiltration of the hospital's systems. Analysis of the attack techniques, infrastructure connections to previous operations, linguistic patterns, and server registrations pointed to North Korean involvement. While local media associated the breach with the Kimsuky group, authorities did not explicitly confirm this attribution. This incident is part of a broader trend of North Korean cyber activities targeting healthcare organizations, including ransomware operations linked to clusters such as Andariel and Lazarus.

The breach at SNUH underscores the vulnerability of healthcare entities to state-sponsored cyber attacks. The scale of data exfiltration affected nearly 850,000 individuals, highlighting the potential for large-scale privacy violations in the medical sector. The use of internationally distributed servers demonstrates the complex, cross-border nature of such intrusions. Although specific details about SNUH's operational scale, service portfolio, or organizational structure are not provided in the available information, the incident itself illustrates the hospital's role as a critical infrastructure target. The attribution to North Korean actors aligns with documented campaigns where healthcare data is stolen for potential espionage, financial gain, or disruptive purposes. This event contributes to the understanding of threat landscapes facing medical institutions globally, particularly those in regions with heightened geopolitical tensions.