The KNDA breach shows how AI can turn seemingly limited personal data into a map of influence, relationships and national security vulnerabilities.
Jang Seok-kwang
The author is the general secretary of the Academy of National Intelligence.
Last month, reports emerged that the online training system of the Korea National Diplomatic Academy (KNDA) had been hacked, exposing the names, departmental affiliations, job titles and email addresses of up to 10,000 current and former diplomats, as well as government officials stationed at various ministries. The Ministry of Foreign Affairs stated that sensitive personal information, including resident registration numbers, mobile phone numbers and home addresses, was not stored in the system and was not compromised. At first glance, this may appear to be a limited incident. But the more important question is not what information was leaked, but what can be done with it.
During the 1980s and 1990s, while investigating espionage cases, I encountered numerous directives issued by North Korean intelligence agencies. Many contained assessments of future leaders, government policy directions, and influential figures within civic organizations. What mattered to them was not an individual’s basic profile, but the network of relationships: how power moved, who influenced whom, and how future centers of power might form.
Following the Sept. 11 terrorist attacks in 2001, the United States adopted a similar approach in its decade-long search for Osama bin Laden. For years, U.S. intelligence failed to locate him because he avoided digital communication. Eventually, the Central Intelligence Agency (CIA) reframed the question. Instead of asking “Where is bin Laden?” it asked “Who is connected to bin Laden?” The agency focused on his trusted courier. By tracing the courier’s connections and mapping the relationships among people, the CIA ultimately identified bin Laden’s hideout.
The nature of intelligence warfare is undergoing a fundamental transformation. In the past, intelligence operations centered on acquiring military secrets or classified diplomatic documents. Today, cognitive warfare and influence operations have emerged as major battlefields.
This shift is also evident in real-world military and intelligence operations. The United States has employed AI for intelligence analysis and social network analysis in operations related to Venezuela and Iran. In Venezuela, AI integrated massive volumes of data to analyze relationships among individuals and organizations. In Iran, AI modeled the country’s integrated air defense system as a single network, supporting target prioritization and operational decision-making.
The names, affiliations, job titles and email addresses of the 10,000 individuals exposed in the KNDA breach may not appear to constitute highly sensitive personal information when viewed individually. From an intelligence perspective, however, each represents a potential point of departure. AI can combine leaked data with public information and previous breaches to reconstruct professional connections, institutional links and patterns of influence.
The real problem begins here. When datasets leaked at different times and from different sources are combined within a single analytical environment through the integration of multiple data sources, or “data fusion,” entirely new relationships emerge — relationships that were invisible when each dataset was viewed separately. In the AI era, the value of information is determined less by its volume than by its connectivity. Korea has already experienced repeated large-scale data breaches involving telecommunications companies, credit card firms and logistics providers. Analysts also note that vast quantities of personal information concerning Korean citizens are circulating on the dark web. If the KNDA data were combined with these existing leaked datasets, the implications could escalate to an entirely new level.
The critical issue is therefore not that several thousand records of personal information were leaked. Rather, it is that once scattered fragments of data are connected into a comprehensive relational network, they can generate entirely new intelligence capable of revealing the structure of the nation’s diplomatic and security networks, its patterns of influence, and even the future flow of decision-making.
This trend is already visible much closer to home. In my own case, during the past month alone, five phishing emails impersonating me were sent to national security research institutes and experts. These emails were disguised as legitimate materials on current security issues, bearing subject lines such as one seeking survey participation and another that said “The Impact of the Deepening North Korea-Russia Relationship on the Korean Peninsula.” Conversely, I myself have received multiple phishing emails impersonating research institutes and colleagues with whom I regularly communicate.
No single incident is sufficient to conclude that a particular country or organization was responsible. Nevertheless, Microsoft’s assessment that state-sponsored cyber operations are increasingly targeting not only government agencies but also research institutions, academic organizations, and expert communities suggests that these incidents should not be dismissed lightly. If such attacks are intended to complement intelligence collection against government institutions, hackers are likely to be less interested in individual researchers than in the people and institutions they connect — and in the network itself.
Just before I finished writing this article, I received another message from a senior colleague, K. He told me he had once again received a phishing email impersonating me. For a brief moment, I could only laugh in disbelief before regaining my composure. As the old Korean saying goes, “When flowers fall, one should not blame the wind.”
In cybersecurity, the attacker almost always enjoys the advantage. Attackers can use AI to launch tens of thousands of attacks at minimal cost, while defenders must invest enormous resources to prevent even a single successful intrusion. Most organizations therefore cannot pursue maximum security; they can only afford acceptable security. New technologies are almost always adopted first by attackers, which is why it remains virtually impossible to prevent hacking completely.
The essential question raised by the KNDA cyberattack is not what information was leaked, but what can be done with that information. In the age of AI, the essence of hacking is no longer stealing files — it is reading and reconstructing networks of relationships. What we must ultimately protect is not merely our computers, but our nation’s trust and the networks upon which it depends.
This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
Click Here For The Original Source.
