Defense Ministry says unauthorized access breached military medical imaging system holding records of 1.15 million personnel

An unauthorized party accessed a mobile medical imaging system operated by the Korea Armed Forces Medical Command late last year, gaining entry to the personal medical records of military personnel, it has been revealed.

The Defense Ministry said no actual data leak has been confirmed, but the incident exposed serious vulnerabilities in a system holding medical images belonging to about 1.15 million people.

A Defense Ministry official said Friday that unauthorized access to the Picture Archiving and Communication System, or PACS, was detected during a security audit of the Armed Forces Medical Command in April. "We immediately suspended system operations upon becoming aware of the situation, and the military plans to implement measures to prevent a recurrence based on the results of the investigation," the official said.

PACS stores medical images — including X-rays, computed tomography scans and magnetic resonance imaging — and allows medical staff to retrieve them.

A joint investigation team comprising the Defense Ministry, the Armed Forces Cyber Command, the Defense Counterintelligence Command and the Armed Forces Medical Command concluded last month that abnormal access had been made to approximately 8 gigabytes of data — equivalent to about 1,000 images — between November and December last year.

Six military hospitals are suspected of being affected: those in Goyang, Yangju, Pocheon, Gangneung, Guri and Daegu. The hospitals serve enlisted soldiers, non-commissioned officers, commissioned officers and general officers.

However, whether any data was actually leaked has not yet been confirmed.

The unauthorized party was able to access PACS through an open communications port.

It was also revealed that the communications port, which could serve as an entry point for intrusion, had remained open from November last year through March this year.