Suspicions that South Korea’s classified wartime operational plan may now be in the hands of the North Korean army continued to roil South Korea on Tuesday after a lawmaker revealed more disturbing details about the alleged North Korean hacking of South Korea’s military network system last year.

According to Rep. Rhee Chul-hee of the ruling Democratic Party, a trove of operational schemes drafted by the South Korea and the US militaries were leaked by hackers of North Korean origin, who breached South Korea’s military intranet and internet server in September last year.

Among the secrets stolen were the OPLAN 5015, which includes the so-called decapitation plan of the regime’s leader Kim Jong-un, and the OPLAN 3100, which deals with the North’s small-scale provocations such as its artillery attack on a South Korean island of Yeongpyong in 2010, Rhee said.

“It was confirmed that suspected North Korean hackers hacked into the Defense Integrated Data Center and caused a massive leak of classified military documents,” Rep. Rhee said Tuesday, referring to the military network system managed by the Defense Ministry.

The ministry’s spokesman Moon San-gyun declined to comment on Rhee’s claim, citing security concerns.

The leak of operational plans was reported in December last year for the first time. At the time, the ministry acknowledged that some classified information had been leaked, but said the breach was “not serious” because most operational plans were updated.  

Rep. Rhee, citing an undisclosed ministry report that he had obtained, claimed a total of 235 gigabytes of data containing classified documents were stolen by the hackers. Only 20 percent of them had been identified by the ministry.

The leaked data included 295 classified documents, with 226 designated as “secret,” 42 as “confidential” and 27 for “official use only.” More than 80 percent of 226 secrets were related to the allies’ special warfare operation inside North Korea in the event of a war, according to Rhee.

“Some of the leaked documents include nonclassified military information about South Korea’s missile defense operational concept, such as Kill-Chain,” an aide from Rhee’s office was quoted as saying by local daily Chosun Ilbo.

Among the leaked documents about the decapitation plan were detailed procedures to monitor the movement of the North Korean leadership, contain their shelter and escape routes, conduct an air assault on facilities and destroy the leadership or secure their whereabouts.

Earlier this month, Defense Minister Song Young-moo revealed a plan to establish a “decapitation unit” by Dec. 1. Although specific task organization has remained confidential, analysts suspect it would be a brigade-level unit consisting of US-type special warfare forces.

Meeting minutes about the joint military exercise Ulchi Freedom Guardian, military documents about the protection of military units and civilian structures, and even reports to the allies’ senior commanders were also leaked, the lawmaker said.

North Korea has been suspected of launching a series of cyberattacks targeting South Korea’s military network, financial system and government infrastructure. The communist regime has also been blamed for the outbreak of ransomware in May that affected hundreds of thousands of computers around the world.

If the latest version of operational plans has fallen into the hands of North Korea, Pyongyang would be better able to cope with the allies’ pre-emptive strike, leaving the allies more vulnerable to North Korea’s evolving nuclear and missile capabilities, an analyst said.

“An operational plan details our military maneuvers down to the specific level. It means that Kim Jong-un is able to keep track of every movement and can respond to it,” said Shin In-gyun, president of Korea Defense Network, a Seoul-based think tank. 

By Yeo Jun-suk (jasonyeo@heraldcorp.com)