Korea Internet & Security Agency (KISA) hosts the 2025 Hack the Challenge Bug Bounty results-sharing session and awards ceremony with the Ministry of Science and ICT, Korea Social Security Information Service (SSiS), and Korea Education and Research Information Service (KERIS)./Courtesy of KISA

Korea Internet & Security Agency (KISA) said on the 21st it held the "2025 Hack the Challenge Bug Bounty"成果 sharing session and awards ceremony with the Ministry of Science and ICT, Korea Social Security Information Service (SSiS), and Korea Education and Research Information Service (KERIS).

"Hack the Challenge" is a bug bounty program that rewards white-hat hackers who report security vulnerabilities, and KISA has been running it for eight years. This year, in cooperation with Korea Social Security Information Service (SSiS), the scope of inspections was expanded to the medical sector, and 10 hospitals, including Seoul St. Mary's Hospital, Uijeongbu Eulji University Hospital, and Chungnam National University Hospital (CNUH), participated to conduct vulnerability checks.

The competition ran for about two months from July to August, with a total of 21 institutions and corporations participating. A total of 618 white-hat hackers, including those in the general and university divisions, reported 1,837 vulnerabilities, the most ever and about a 56% increase from a year earlier.

Reports of high-risk vulnerabilities also increased significantly. Ninety-nine reports of high-risk vulnerabilities were confirmed, including possible server administrator privilege takeover and potential medical information leakage, a 183% increase from a year earlier. Reported vulnerabilities were immediately forwarded to each institution for action.

Total rewards paid this year amounted to 78.76 million won, and the Minister of the Ministry of Science and ICT's award was presented to the overall grand prize winners in the general and university divisions.

Lee Dong-geun, head of KISA's Digital Threat Response Headquarters, said, "Hack the Challenge has served as an opportunity to strengthen the security systems of corporations and institutions and to spread the operation of in-house bug bounties," adding, "We will expand the scope of inspections to various fields to vitalize a bug bounty ecosystem in which the public and private sectors participate together."

※ This article has been translated by AI. Share your feedback here.