ED Internet security loophole

NTS didn't even know its website was breached for days

Significant security issues arose on the website for the simplified year-end tax settlement service opened by the National Tax Service on Jan. 15. Aside from the existing public key and financial certificates, the NTS introduced simple authentication methods already in use by private companies as of last year. However, the tax agency exposed a security loophole this year while adding another simple certification method. As annual tax return data contains personal information, such as income, family relations and medical records, this security loophole leaves individuals' private data vulnerable to illicit access.

For four days, anyone could reportedly look up other people's year-end tax adjustment data by just connecting to the simplified service, inputting another individual's name and resident registration number and then presenting a simple certificate not related to them. As there are many names and resident registration numbers traded secretly on the internet, cybercriminals here or abroad could steal as much personal data as they wanted. Moreover, the NTS did not even discover these security breaches on its website by itself, but rather was told by online security experts who had found them.

State tax agencies that hold taxpayers' income data are one of cybercriminals' primary targets. In 2015, the website of the U.S. Internal Revenue Service was compromised, leading to the leaking of information on 700,000 taxpayers and erroneous tax refunds worth $50 million. The number of cyberattacks on the NTS also jumped 2.7 times in 2020 from the previous year, to 6,106. The NTS' security network, which withstood all these external attacks, exposed its flaws in the process of upgrading its system.

NTS officials said that they checked the system quickly and solved the problem on the evening of Jan. 18. Nevertheless, the NTS should confirm what information was compromised during the four days, disclose the results transparently and take all the necessary steps to protect individuals. It also needs to overhaul its security system to ensure that there is no easing of the vigilance required at such an agency that handles sensitive taxpayer data.