Skip to main contentSkip to navigationSkip to navigation
South Korean tanks taking part in a military exercise near the demilitarised zone
South Korean tanks taking part in a military exercise near the demilitarised zone in 2000 to prepare for a possible North Korean attack. Photograph: Ahn Young-joon/AP
South Korean tanks taking part in a military exercise near the demilitarised zone in 2000 to prepare for a possible North Korean attack. Photograph: Ahn Young-joon/AP

North Korean hackers may have stolen US war plans

This article is more than 14 years old
Files outline South Korea and Washington's strategy in event of war on the peninsula

South Korea's military is investigating a cyber attack in which North Korean hackers may have stolen secret defence plans outlining Seoul and Washington's strategy in the event of war on the Korean peninsula.

The highly sensitive information, codenamed Oplan 5027, may have found its way into hostile hands last month after a South Korean officer used an unsecured USB memory stick to download it.

It reportedly contained a summary of military operations involving South Korean and US troops should North Korea conduct a pre-emptive strike or attempt to invade.

According to the Chosun Ilbo, a South Korean newspaper, the document outlines troop deployments, a list of North Korean targets, amphibious landing scenarios and how to establish a post-war occupation.

The Yonhap news agency said the plan allowed for the deployment of 700,000 US troops in the event of a full-scale war.

Embarrassed officials in Seoul attempted to play down its importance. The document was not a full text of the plans, said the defence ministry spokesman Won Tae-jae, adding that the 11-page file was intended simply to brief military officials and did not contain sensitive information.

The investigation has yet to establish how the hackers were able to get in or whether they were acting with North Korean support. One theory is that they used an internet protocol address registered in China, a preferred route for North Koreans attempting to hack into files on foreign networks.

The US has 28,500 troops based in South Korea. David Oten, a spokesman for the US military in Seoul, said: "As a matter of policy we do not comment on operational planning or intelligence matters, nor would we confirm details pertaining to any security investigation."

The mishap occurred in one of the world's most militarily sensitive regions. Tensions between the two Koreas have grown this year amid Pyongyang's refusal to abandon its nuclear weapons programme. Although the three-year Korean war ended in 1953 the countries have never signed a peace treaty and are divided by one of the world's most heavily fortified borders.

Faced with the military might of the world's only superpower, North Korea appears to believe it can at least gain an advantage in cyberspace. It is thought to have been responsible for high-profile cyber attacks in July that caused web outages at the White House and its South Korean equivalent, the Blue House. Reports in South Korea said investigators had traced the Chinese IP address used in those attacks to North Korea's post and telecommunications ministry.

The communist state is believed to operate an internet warfare unit, staffed by between 500 and 1,000 people, that attempts to hack into US and South Korean military networks in search of classified information or to throw government institutions into chaos.

The revelation that such sensitive information may have fallen into North Korean hands has provoked outrage in sections of the South Korean media. In a stinging editorial, the Chosun Ilbo noted that tens of thousands of heavily armed South Korean and US troops were involved in a tense standoff along the two Korea's land and maritime borders.

"If North Korean hackers can infiltrate the south's cyber borders at will, then all of those troops and weapons protecting the country along the border are useless," it said.

Most viewed

Most viewed