Confirmed cases of the North Korean IT Worker Scheme across the EU
Dear European Union Agency for Cybersecurity (ENISA),
Under the right of access to documents under Article 15(3) TFEU and Regulation (EC) No 1049/2001, I am requesting access to all existing documents held by the Agency containing information on:
1. Aggregate statistics, reports, threat assessments, or incident summaries concerning fraudulent IT workers or remote contractors associated with the Democratic People's Republic of Korea (DPRK) operating within EU Member States or targeting EU entities.
2. Any available overviews, briefing notes, or data tables detailing confirmed or suspected cases across Member States, organized by year (from 2020 to 2026) and country, where such records already exist.
If this request is deemed too broad or if specific documents cannot be released due to exceptions under Article 4 of Regulation 1049/2001, please provide partial access / redacted versions, or suggest how the scope may be narrowed.
Yours faithfully,
Pavel Rău
Dear Mr Rău,
We hereby acknowledge receipt of your Application for Public Access to
Documents, registered today 17 August 2026.
In accordance with Regulation (EC) No 1049/2001 regarding Public Access
to European Parliament, Council and Commission documents, applications
are handled within 15 working days. In case this time limit needs to be
extended, you will be informed in due course.
The estimated deadline for reply applicable to this request is therefore 7
September 2026.
Kind regards,
ENISA Public Access to Documents Team
[1]ENISA Public Access to Documents
[2]ENISA
Agamemnonos 14, 15231 Chalandri, Attiki, Greece |
enisa.europa.eu
[3]Twitter [4]Facebook [5]LinkedIn [6]YouTube
Dear Mr. Rau,
Please find attached ENISA's response to your email related to the
Ares(2026)7940504 public access to documents request with the ARES
registration number.
At your disposal for any further clarification you might need.
Kind regards,
[1]ENISA Public Access to Documents
[2]ENISA
Agamemnonos 14, 15231 Chalandri, Attiki, Greece |
enisa.europa.eu
[3]Twitter [4]Facebook [5]LinkedIn [6]YouTube
From: access-documents <[ENISA request email]>
Sent: Monday,17 August, 2026 14:06
To: Pavel Rău <[FOI #17422 email]>
Subject: RE: access to documents request - Confirmed cases of the North
Korean IT Worker Scheme across the EU
Dear Mr Rău,
We hereby acknowledge receipt of your Application for Public Access to
Documents, registered today 17 August 2026.
In accordance with Regulation (EC) No 1049/2001 regarding Public Access
to European Parliament, Council and Commission documents, applications
are handled within 15 working days. In case this time limit needs to be
extended, you will be informed in due course.
The estimated deadline for reply applicable to this request is therefore 7
September 2026.
Kind regards,
ENISA Public Access to Documents Team
[7]ENISA Public Access to Documents
[8]ENISA
Agamemnonos 14, 15231 Chalandri, Attiki, Greece |
enisa.europa.eu
[9]Twitter [10]Facebook [11]LinkedIn [12]YouTube
Dear European Union Agency for Cybersecurity,
Please pass this on to the person who reviews confirmatory applications.
I am filing the following confirmatory application with regards to my access to documents request 'Confirmed cases of the North Korean IT Worker Scheme across the EU'.
The initial decision to my request refused access, arguing that processing the request would entail disproportionate administrative burden, that the requested documents likely fall outside ENISA's competence and that such case files are primarily held by Member States authorities. The decision also suggested consulting the ENISA Threat Landscape 2025 report.
After consulting the ENISA Threat Landscape 2025 report, I observed that figure 36 ("Reported DPRK-nexus intrusion sets activities in the EU") explicitly cites an internal "ENISA dataset" as the source for mapping these specific intrusions across the EU Member States. This demonstrates that aggregated, statistical data regarding these specific intrusions is held directly by ENISA, thus making my request fall within its competence.
Furthermore, regarding the cited "disproportionate administrative burden", the Agency did not confer with me to find a fair solution before issuing a refusal, as obligated by Article 6(3) of Regulation (EC) No. 1049/2001, despite my explicit offer to narrow the scope in my initial request.
To eliminate any administrative burden and address concerns regarding third-party ownership, I am formally narrowing the scope of my request exclusively to the following:
- An electronic database extraction (in spreadsheet/CSV format) from the internal "ENISA dataset" utilized to generate Figure 36 of the Threat Landscape 2025.
- This extraction should filter the "DPRK-nexus intrusion sets" to provide aggregate incident counts tagged or categorized under identifiers such as "Famous Chollima," "IT worker," or "extortion/revenue generation."
- The data should be broken down solely by year (2020–2026) and by EU Member State.
As established by the jurisprudence of the Court of Justice of the European Union, a standard extraction from an electronic database using existing search parameters constitutes an existing document under Regulation 1049/2001. I am fully amenable to receiving an anonymized version of this extraction that removes sensitive third-party operational indicators while preserving the raw numerical counts by year and country.
A full history of my request and all correspondence is available on the Internet at this address: https://www.asktheeu.org/request/confirm...
Yours faithfully,
Pavel Rău
Registration number: [1]Ares(2026)8333789
Dear Mr. Rau,
We hereby acknowledge receipt of your confirmatory Application for
Public Access to Documents, registered today 01 September 2026.
In accordance with Regulation (EC) No 1049/2001 regarding Public Access
to European Parliament, Council and Commission documents, applications
are handled within 15 working days. In case this time limit needs to
be extended, you will be informed in due course.
The estimated deadline for reply applicable to this request is therefore
22 September 2026.
Kind regards,
[2]ENISA Public Access to Documents
[3]ENISA
Agamemnonos 14, 15231 Chalandri, Attiki, Greece |
enisa.europa.eu
[4]Twitter [5]Facebook [6]LinkedIn [7]YouTube
Dear Mr. Rau,
Please find attached ENISA's response to your email related to the
[1]Ares(2026)8333789 confirmatory application with the ARES registration
number.
At your disposal for any further clarification you might need.
Kind regards,
[2]ENISA Public Access to Documents
[3]ENISA
Agamemnonos 14, 15231 Chalandri, Attiki, Greece |
enisa.europa.eu
[4]Twitter [5]Facebook [6]LinkedIn [7]YouTube
From: access-documents <[ENISA request email]>
Sent: Tuesday, September 1, 2026 1:00 PM
To: Pavel Rău <[FOI #17422 email]>
Cc: access-documents <[ENISA request email]>
Subject: RE: Internal review of access to documents request - Confirmed
cases of the North Korean IT Worker Scheme across the EU
Registration number: [8]Ares(2026)8333789
Dear Mr. Rau,
We hereby acknowledge receipt of your confirmatory Application for
Public Access to Documents, registered today 01 September 2026.
In accordance with Regulation (EC) No 1049/2001 regarding Public Access
to European Parliament, Council and Commission documents, applications
are handled within 15 working days. In case this time limit needs to
be extended, you will be informed in due course.
The estimated deadline for reply applicable to this request is therefore
22 September 2026.
Kind regards,
[9]ENISA Public Access to Documents
[10]ENISA
Agamemnonos 14, 15231 Chalandri, Attiki, Greece |
enisa.europa.eu
[11]Twitter [12]Facebook [13]LinkedIn [14]YouTube