On 8 November 2026 developer Antonio Cheong published a write-up, covered by Privacy Affairs, about a gap in the DNS setup of South Korea's National Cyber Security Center (NCSC). Two of the agency's three nameservers, ns1.aegis-k.com and ns2.aegis-k.com, sat on a domain that had expired and could be registered by anyone. The zone for ncsc.go.kr was also unsigned: it had no DNSSEC. The NCSC is the body where people report vulnerabilities in government systems.
What actually happened
A nameserver tells the rest of the internet where a domain's websites and mail servers are. If the domain hosting that nameserver lapses, whoever registers it next can answer a share of the lookups with addresses they choose. In Cheong's post, a dig query against the .kr registry servers, logged on 8 September 2026 (Japan time), shows ncsc.go.kr delegated to ns1.aegis-k.com, ns2.aegis-k.com and ns.ncsc.go.kr. An RDAP lookup for aegis-k.com returned "Object not found." Privacy Affairs reports that the .com registry shows the domain registered again on 7 September 2026, which fits Cheong's account. Cheong says he paid "a couple hundred dollars" to register the expired nameserver domains he found "so nobody else could."
Two things in the account should be kept apart. Cheong says South Korea "fixed the issue within 2 months." Privacy Affairs checked on 8 November and found the .kr registry now sends ncsc.go.kr to a single nameserver, ns.ncsc.go.kr. But the agency's own nameserver still lists the two aegis-k.com servers beside itself. Under RFC 2181 section 5.4.1, a zone's own authoritative data outranks referral data from a parent. Privacy Affairs concludes that resolvers can therefore still send some lookups to the expired-domain servers. It adds that the domain is paid up only until 7 September 2027. The report quotes no Korean official response, so the agency's current position is unknown.
Nothing reported so far shows anyone other than Cheong held the domain, or that any data was intercepted.
The case for tougher rules
The strongest argument for stricter mandates is that this is an agency whose job is to defend the state. If it can miss something this basic, voluntary hygiene is not working, and Cheong says he found about 21 similar cases on government domains worldwide. He says the other governments "aren't really responding." Regulators have recently moved toward harder consequences. On 10 September 2026 the Personal Information Protection Commission (PIPC) announced that amendments to the Personal Information Protection Act take effect on 11 September. They introduce a punitive surcharge of up to 10% of total revenue for repeated or grossly negligent leaks, and add a duty to notify people when a leak is merely possible. The scale of the regime is real. In June 2026 the PIPC fined Coupang a record 624.68 billion won, of which 423.58 billion won concerned a breach affecting about 37.5 million people.
Why penalties are the wrong tool here
The penalty regime is aimed at private data controllers after harm occurs. This incident is a configuration lapse in a government zone, with no reported leak. A revenue-based surcharge has no obvious application to a public agency. Government's own answer is administrative. On 1 October 2026 the PIPC published a joint public-sector cyber security plan. It would raise discipline standards for supervisors after serious leaks, and expand the National Intelligence Service's cyber security assessments from 153 agencies this year to more than 2,000 by 2028.
That direction is sensible, but the DNS case shows what it must contain. The failure was not a missing policy. It was a record nobody re-checked when a vendor domain lapsed. Discipline after a breach arrives too late for that class of error. The proportionate response is cheap, continuous and automatic:
- Monitor every NS record, and the registration status of the domain behind each one, with alerts well before expiry.
- Remove delegations to third-party domains the agency does not control, or bring those domains under government registration with multi-year renewal.
- Sign government zones with DNSSEC, so forged answers are rejected even if a record goes stale.
- Publish a disclosure channel that works, which Cheong says South Korea's did.
These measures impose almost no burden on innovation. Heavy rules on private platforms can slow product launches and push smaller firms out. Checks like these cost the public sector little.
What to watch
Three things will show whether Seoul treats this as a lesson. The first is whether the agency removes the two aegis-k.com lines from its own zone, rather than relying on the registry-level fix. The second is whether the expanded assessments test third-party dependencies like DNS delegations. The third is whether the other governments Cheong says he contacted act on the list he is considering sending to ICANN. The 2017 ACM CCS research on nameserver hijacking and the August 2026 expired-domain case Privacy Affairs describes, involving phone-number zones for Saint Helena, Diego Garcia and Ascension Island, show the technique is old and still working.
South Korea's recent enforcement shows it can act on private-sector failures. Public-sector failures of this kind call for plumbing, not punishment. A government that wants citizens to trust its data protection regime should be able to show its own front door is locked, and it can show that without a new statute.