Hacking attempts against government-funded research institutes in science and technology have surged 73.2% in one year. Despite this, dedicated information security personnel were found to be less than half of the government's minimum standard.
According to documents submitted by the Ministry of Science and ICT and the National Research Foundation of Korea (NST) to Kim Nam-guk, a Democratic Party of Korea lawmaker on the National Assembly's Science, ICT and Communications Committee, hacking attempts against NST and its 23 subordinate government-funded research institutes increased from 123 in 2024 to 213 in 2025. This represents an increase of approximately 73.2%. Hacking attempts detected this year also reached 164 as of August.
According to NST's mock hacking data for government-funded research institutes from 2024 to 2025, there were 23 cases where vulnerabilities discovered through mock hacking were repeatedly pointed out for more than two years.
A significant number of vulnerabilities were also found in server vulnerability inspections. In the case of KIST (Korea Institute of Science and Technology), 2,685 vulnerabilities were found across 199 servers subject to inspection in 2025. For KISTI (Korea Institute of Science and Technology Information), 2,921 cases were found across 245 servers. In the case of ETRI (Electronics and Telecommunications Research Institute), 1,490 vulnerabilities were found across 1,459 servers.
However, internal personnel responsible for cyber threats and security management were insufficient. As of 2026, the minimum standard number of information security personnel for NST and its 24 subordinate government-funded research institutes is a total of 116, but actual dedicated personnel numbered only 54. This falls short of even half of the minimum standard personnel count.
In particular, KISTI, which oversees operations such as national supercomputers, faced 174 hacking attempts from 2022 to August this year, yet had only 3 dedicated personnel, falling short of the minimum standard of 5. The servers managed by KISTI number 11,132, and information systems number 51, meaning one dedicated personnel member manages approximately 3,711 servers.
The antivirus installation rate was also low. As of last September, out of 19,041 servers subject to inspection at NST's subordinate government-funded research institutes, only 1,654 had antivirus installed, a rate of approximately 8.7%.
Among the 766th DMZ (Demilitarized Zone) servers connected to the internet through external services such as homepages and portals, it was found that antivirus was installed on only 394, or about 51.4%.
Kim Nam-guk (Rep.) emphasized, "Hacking attempts targeting government-funded research institutes have increased by 73% in one year, yet the antivirus installation rate for servers subject to inspection is less than 10%, and security personnel managing them are only at half the level of the minimum standard." He added, "Security personnel standards and management systems must be comprehensively re-examined to reflect actual risk levels by institute, including not just scale but also the number of servers and information systems, external public services, and the status of hacking attempts and vulnerability occurrences."
in TECH
