The Finance Ministry said Friday it has found that some of its computers were infected with a virus from 2010 to 2011 and admitted information may have been leaked.
The ministry denied confidential information such as personal data on taxpayers had been leaked but declined to provide details, including which departments had been affected by the apparent cyber-attack. It will probe the incident with police.
The infection was reported to the ministry Tuesday by a company it had commissioned to check its computer security system starting in May.
The contagion started in January 2010, the ministry said based on the company's report, suggesting information could have been leaked for over two years. The last infection occurred in November 2011, after which the apparent attack suddenly stopped.
An ongoing probe, in which around 2,000 computers at the ministry were checked, turned up 123 that were infected with Trojan horse malware, which is often sent as an e-mail attachment with the purpose of giving a hacker unauthorized access to a computer.
The ministry, which has yet to identify the route of the infection, has already changed the hard-disks on the affected computers while limiting data transmission when they are connected to the Internet.
The virus was not detected by antivirus software installed on the computers, triggering speculation it could be a new type of Trojan horse, ministry officials said.
The infection has been found mainly with computers used by relatively junior officials, and data possibly leaked may include documents prepared for meetings within the ministry, one of the officials said. Computers used by senior officials, including the minister, vice ministers and directors general, were not affected.
"It is not that the personal information that we have was widely leaked," one official told reporters.
Last month government websites, including the ministry's, were accessed by unauthorized users. The incident came after a group of Internet hackers called Anonymous threatened an attack. It is not known if Anonymous is connected to the Trojan horse attack.