Allied Intelligence — 2026-05-20

South Korea NIS Seeks Broader Authority to Investigate Cyberattacks on Private Companies

BLUFPassage of the amendment is likely by December 31, 2026, forcing South Korean firms to grant NIS investigators network and personnel access at the suspicion stage rather than post-attribution.

South Korea's National Assembly Intelligence Committee approved a revision to the NIS Act on May 7, formally adding "economic security" to the agency's mandate and permitting the National Cyber Security Center to investigate private-sector cyberattacks before attribution is established 12. The amendment would authorize field inspections, document requests, and witness interviews at targeted firms 2, replacing a framework under which NIS could not intervene unless a state connection was already proven 1. MLex reported the bill cites recent hacking incidents at SK Telecom and KT as justification and still requires Legislation and Judiciary Committee review and a plenary vote before enactment 2.

Analysis
The amendment likely passes by December 31, 2026, per narrow corroboration from MLex and a single translated account, authorizing NIS investigators to enter targeted firms before attribution is established, a reversal of the prior threshold requiring proven state involvement. Kimsuky's four concurrent Q1 2026 campaigns against defense and corporate targets are the class of intrusion this framework is designed to intercept early. The economic security framing may instead serve primarily as domestic surveillance cover, with ambiguous attribution standards granting routine corporate access well beyond the stated counterintelligence rationale. South Korean firms in strategic sectors face a timing decision on NIS-compliant incident-response frameworks now, ahead of final enactment.

2 sources