South Korea’s cybersecurity risks are coming into sharper focus as attacks on government systems accelerate alongside a wave of data breaches across the financial sector. The country’s National Tax Service recorded more than 73,000 external hacking attempts in the first nine months of 2026, nearly three times the combined total for the previous five years. For U.S. cybersecurity companies, investors and businesses operating in South Korea, the surge underscores growing demand for stronger threat detection, real-time defenses and protection of sensitive financial data.
The National Tax Service recorded 73,283 external hacking attempts from January through September 2026, according to data submitted to Rep. Lee Jong-wook of the opposition People Power Party, a member of the National Assembly’s Finance and Economy Committee. The figures were disclosed on October 13.
The nine-month total was 2.8 times the 26,460 attempts recorded over the entire 2021–2025 period. It was also 7.6 times the 9,643 attempts reported for all of 2025.
Annual totals were 4,849 in 2021, 4,227 in 2022, 3,053 in 2023 and 4,688 in 2024, before rising to 9,643 in 2025. The latest figures point to a sharp acceleration in attempted attacks, although they do not establish that any intrusion succeeded.
Attempts to steal information accounted for the largest category from January through September 2026, totaling 33,673, or 46% of all reported attempts. That was more than 10 times the 3,228 recorded in the category for all of 2025.
Other reported attack types included information gathering, with 11,730 attempts; website defacement, with 8,431; attempts to gain system privileges, with 7,709; and denial-of-service attacks, including distributed denial-of-service attacks, with 5,547.
Based on the IP addresses used in the attempts, 42,326 were classified as domestic and 30,957 as originating overseas. The United States accounted for 12,980 overseas attempts, or 41.9%, followed by Vietnam with 3,472, or 11.2%. Together, the two countries represented more than half of the attempts classified as foreign. The IP-based classification does not necessarily identify the attackers’ actual locations or nationalities.
The National Tax Service said it had experienced cyberattacks and hacking attempts but that none had resulted in a confirmed breach. The statement does not eliminate concerns about the potential consequences of a successful intrusion. The agency holds sensitive information about taxpayers’ income and assets, making a compromise potentially damaging to individuals and public confidence.
The increase comes as South Korea’s financial sector faces a series of cybersecurity incidents. Personal information leaks have been identified at major commercial banks, including Shinhan Bank and KB Kookmin Bank, as well as at savings banks and finance companies. Financial regulators convened an emergency inspection meeting on October 4 in response to the incidents.
Lee said the tax authority should not use the absence of confirmed breaches to avoid accountability. He called for a thorough investigation into the reasons for the increase, more rigorous checks for security vulnerabilities and stronger real-time systems to detect and block attacks.
The surge in attempted intrusions does not by itself prove that the agency’s defenses have failed. But the scale of the activity is likely to intensify scrutiny of how South Korea protects sensitive public data. For cybersecurity vendors and investors, the figures highlight a growing security challenge, while the central issue for taxpayers and businesses remains whether government agencies can detect attacks quickly and prevent a single successful breach from exposing highly sensitive records.
