Every Korean apartment I’ve lived in has the same thing bolted to the entry wall: a touchscreen wallpad (월패드, literally “wall pad”) that runs the gas valve, the front gate camera, room heating, and the elevator call button. In 2021, a hacker breached that camera in 638 apartment complexes — over 400,000 homes.
He sold the footage online. He got four years. And in December 2025, a different set of hackers did roughly the same thing to about 120,000 more cameras nationwide. Here’s what my wallpad actually does, what happened both times, and the three things I changed after I sat down and read the actual court filings instead of half-listening to the news.
What My Wallpad Actually Controls (Gas, Heat, the Gate, and My Electric Bill)
The panel sits at chest height by our front door, and on the surface it looks like a fancy intercom. Press one button and it rings the building’s main security desk. Press another and you get a live video feed from the camera at the apartment complex’s main gate — useful when a delivery driver is buzzing and you want to actually see who it is before unlocking anything. But the wallpad does a lot more than let people in. From the same screen I can shut off the gas valve remotely, control heating room by room, check whether the front door is locked, and pull up real-time electricity, gas, and water usage broken down by month.
The feature that surprised me most when we moved in was “outing mode” (외출, oechul, literally “going out”). One tap on the way out the door kills the lights, cuts the gas valve, calls the elevator to your floor, and arms the door sensor — all from a single button, no separate apps, no separate switches. It’s genuinely convenient. It’s also, I’d eventually learn, running through the same panel that has a camera pointed at your front hallway around the clock.
It Started as an Intercom
I didn’t think about any of this for years. The wallpad was just the thing on the wall that buzzed when someone was at the door, and I used maybe three of its functions on a good week. I’ve written before about the digital keypad lock on our own front door — the one that turned into a small family war over who gets to change the passcode — and for a long time I filed the wallpad under the same mental folder: apartment tech, mostly harmless, occasionally annoying.
That changed when I actually read what happened in 2021. Not a headline. The court filing.
638 Complexes, 400,000 Homes: What Happened in 2021
In November 2021, a hacker posted footage on a hacking forum, boasting about remote access to apartment wallpad cameras and offering a full day of footage from a single home for 0.1 bitcoin. Investigators eventually traced the breach to 638 apartment complexes — more than 400,000 households. He was convicted, in a 2024 first-instance ruling, and sentenced to four years in prison, along with a mandatory sex-crime prevention program and a five-year ban from any work involving children, youth, or people with disabilities.
The method wasn’t exotic. Investigators found he’d used a “web shell” exploit — the same basic technique behind Korea’s 2008 Auction data breach, which had exposed roughly 10 million customer accounts. This wasn’t a fresh zero-day; it was an old, well-documented attack aimed at systems that hadn’t been patched against it. Police traced the compromised units to three home-network security vendors — 538, 73, and 56 units respectively, plus 37 more that couldn’t be assigned to a specific vendor — concentrated in Gyeonggi Province (219 homes) and Seoul (106 homes).
What actually unsettled me was how low the technical bar turned out to be. In August 2021, Busan Ilbo newspaper commissioned an authorized penetration test, and two computer-science graduate students breached a 2018-built apartment complex’s wallpad system after just one day of preparation. One day. And the hacker himself reportedly told an interviewer as much back in February 2019, saying wallpad cameras were something “middle schoolers with basic knowledge of computers can easily hack.”
It Happened Again in December 2025 — Different Hackers, Same Weak Passwords
This is the part that made me actually do something instead of filing the story away as a 2021 problem that got fixed. In December 2025, Korean police arrested four separate suspects for hacking roughly 120,000 home and business IP cameras nationwide. Two of them alone accounted for about 63,000 and 70,000 devices respectively. The targets weren’t limited to apartments this time — investigators found gynecology clinics, karaoke rooms, and pilates studios among the compromised feeds, with footage sold for sums up to ₩35 million (about $23,800).
Same country, same basic vulnerability, four years apart, and a wider range of victims. Here’s how the two cases stack up side by side.
| 2021 Case | December 2025 Case |
|---|---|
| Scale: 638 apartment complexes, over 400,000 homes | Scale: ~120,000 IP cameras nationwide |
| Who: 1 hacker, web shell exploit (same method as the 2008 Auction breach) | Who: 4 separate suspects; two alone accounted for ~63,000 and ~70,000 devices |
| Targets: Apartment wallpad cameras | Targets: Apartments plus gynecology clinics, karaoke rooms, pilates studios |
| Outcome: 4-year sentence, sex-crime prevention program, 5-year ban from work with minors/disabled | Outcome: Footage sold for sums up to ₩35 million (~$23,800) |
What that table doesn’t capture is the timeline gap. Four years passed between a hacker publicly bragging about how easy this was and a fresh set of arrests for doing more or less the same thing at a larger scale. That’s not a closed case. That’s a pattern.
What I Actually Changed After Reading the Court Filings
My wife thinks I overreact to this kind of thing — she’s not entirely wrong, and she gave me a look somewhere between amused and concerned when I brought this up over dinner. But I did three things, and none of them took more than twenty minutes total.
First, I put a small strip of opaque tape over the wallpad’s camera lens whenever we’re not using the intercom function. This sounds almost too simple, but a compromised camera doesn’t reliably show any kind of recording light or on-screen indicator — you can’t tell from the panel itself whether it’s being accessed. The tape peels off in two seconds when a delivery driver buzzes and I actually want to see them.
Second, I called the building’s management office (관리사무소, gwalli samuso, literally “management office”) and asked directly: which vendor installed our wallpad system, and has it been checked or patched since the 2021 case? It took two days to get a real answer instead of a shrug, but I got one — our building runs on hardware from a different installer than the ones named in the 2021 complaints, and management confirmed a firmware update had gone through since. That’s a concrete answer, not a guess, and it’s a question any resident can ask.
Third, I went digging through the wallpad’s own settings menu — the one buried under the camera icon I’d never actually tapped before — and found a privacy toggle that disables the lens without touching the intercom audio or the gas and heating controls. It was three menus deep and not labeled anything obvious. If you’ve never opened that menu, it’s worth five minutes.
None of this makes the wallpad hack-proof. What it does is turn a vague sense of unease into three specific things I can point to and say I actually checked.
FAQ: Wallpad Questions Foreigners Ask
What is a wallpad, and does every Korean apartment have one?
A wallpad (월패드) is the touchscreen control panel mounted near the front door of most Korean apartments, typically bundling video intercom, gas-valve control, room heating, door-lock status, and a camera into one unit. It’s standard in apartment complexes built from roughly the 2000s onward; older or smaller buildings may have a simpler intercom without the smart-home functions.
Can I just unplug or disable the wallpad camera myself?
Not easily — you generally can’t unplug the panel without also losing gas-valve and heating control, since they run through the same unit. Covering the lens with tape or checking the camera settings menu for a built-in privacy toggle, as described above, is the more practical fix.
How do I find out if my specific building was affected by either hacking case?
Neither the 2021 case nor the December 2025 case published a public list of affected addresses, for obvious reasons. The most direct path is asking 관리사무소 which vendor manages your system and whether a security patch has been applied since 2021 — the same question I asked mine.
Is this actually a big deal for renters, or just an owner’s problem?
It’s a renter’s problem too — you’re on the other side of that camera regardless of whose name is on the deed. The checklist above takes the same twenty minutes whether you own the unit or you’re three months into a one-year lease.
The wallpad isn’t going anywhere, and I’m not getting rid of it — I still tap outing mode every single morning on my way to the subway. I just don’t leave the lens uncovered anymore.