Korea Moves to Hold Public Agency Leaders Accountable for Cybersecurity Failures

South Korea has unveiled a government-wide plan to strengthen accountability for cybersecurity failures across public institutions, including disciplinary standards that could reach agency leaders when serious incidents result from neglected basic safeguards.

The measures were announced jointly by the Ministry of the Interior and Safety, the National Intelligence Service, the Ministry of Personnel Management and the Personal Information Protection Commission. They follow a series of public-sector incidents, including a breach involving a government startup-support platform and a ransomware attack at a national university hospital.

Government figures show that public institutions suffered 247 data breaches between 2021 and May 2026. Officials said many incidents were linked to failures to observe basic security practices, such as changing default passwords or fixing known vulnerabilities within a reasonable period. Yet no head of an institution has been directly disciplined over a breach, while sanctions against responsible managers and employees have remained uncommon.

The government plans to establish clearer disciplinary rules for violations of baseline information-protection requirements. It will also revise enforcement rules so that supervisors can be held responsible when a serious leak occurs and raise the level of possible penalties. Existing violation categories, which officials consider too broad, will be broken down into more specific standards.

Oversight will expand sharply. The National Intelligence Service's cybersecurity assessment currently covers 153 institutions, but the government aims to include about 2,000 national and public institutions by 2028. New evaluation criteria will deduct points when breaches occur and measure how quickly an organization responds. Results will feed into performance reviews for central government agencies, while local public enterprises will receive cybersecurity indicators in their management evaluations.

The plan also addresses weak staffing and incentives. Only 11 of 49 central administrative agencies currently operate a dedicated cybersecurity division or team. Among 152 institutions assessed last year, 37 did not meet a requirement that cybersecurity personnel represent at least 10 percent of information-technology staff. The government intends to reinforce security staffing and, over time, establish dedicated units led by private-sector specialists.

Officials are considering an information-protection allowance, performance-review benefits and key-position recognition for employees assigned to cybersecurity work. The government will also define core spending needs for replacing outdated software, applying patches, testing vulnerabilities and deploying security tools. It said it would work toward implementing the existing policy goal of directing 15 percent of information-technology budgets to information protection.

The package reflects an effort to pair tougher responsibility with greater institutional capacity, making cyber risk a management issue rather than leaving it solely to technical staff.