Indo-Pacific — 2026-07-30

South Korean Audit Finds 690 Hard Drives and 60000 Classified Files Removed Without Authorization from Nuclear and Aerospace Research Institutes

BLUFStructural gaps in South Korea's internal-drive controls at nuclear and aerospace institutes have already enabled classified file exfiltration, converting a routine security lapse into active proliferation risk.

South Korea's Board of Audit and Inspection reported that 690 hard drives were removed from internal PCs at five of six audited research institutes, including the Korea Atomic Energy Research Institute and Korea Aerospace Research Institute, between October 2024 and September 2025 123. Of 39 drives previously used by departed employees, 12 could not be located or were confirmed outside the institutes 23. At the Korea Aerospace Research Institute, a former employee who moved to a university position retained an unauthorized hard drive and removed it containing 60,956 files from four classified security projects without deleting them 23. SBS and Munhwa Ilbo reported that at three institutes, 14 employees installed unauthorized VPN software, including ZeroTier and Tailscale, on 56 devices to bypass network security without management's knowledge, and that at two institutes 144 of 191 NAS servers were exposed on hacking search engines with 46 running vulnerable software, including one institute whose NAS servers logged roughly 60,000 login attempts from overseas over two months 24.

Analysis
Internal hard drives sat outside entry-exit controls governing laptops and removable media, leaving twelve departed-staff drives with no verified chain of custody, and one researcher's undeleted retention of 60,956 files from four classified projects turns that structural gap into a demonstrated exfiltration pathway rather than a theoretical one. Unauthorized VPN tools and roughly 60,000 overseas login attempts against one institute's NAS servers show the exposure runs from physical media into the network perimeter itself, though poor inventory discipline and routine data hoarding could account for the untraced drives and unerased files without implying deliberate transfer. Reporting rests on the Board of Audit and Inspection's own release, with other domestic outlets amplifying rather than independently corroborating the findings. The affected institutes anchor national strategic technology programs, so any confirmed offsite copy carries proliferation-relevant stakes beyond a routine data-security lapse.

4 sources