South Korea has been on heightened alert against the threat of cyber-attacks by North Korea after it conducted a nuclear test in January and a long-range rocket launch last month, triggering new UN sanctions.
South Korea had previously blamed the North for cyber-attacks against its nuclear power operator. North Korea denied that.
South Korea's National Intelligence Service (NIS) said in a statement it had interrupted the hacking attempt against the railway workers and closed off their email accounts.
The agency issued the statement after an emergency meeting with other government agencies on the threat of cyber-attacks by the North.
The agency detected hacking attempts by the North against workers for two regional railway networks this year, the spy agency said.
"The move was a step to prepare for cyber-terror against the railway transport control system," the agency said.
It did not elaborate on what it thought North Korea's specific objective was in hacking into the system. An agency official reached by telephone declined to comment.
North Korea has been working for years to develop the ability to disrupt or destroy computer systems that control public services such as telecommunications and other utilities, according to a defector from the North.
The United States accused North Korea of a cyber-attack against Sony Pictures in 2014 that led to the studio cancelling the release of a comedy based on the fictional assassination of the country's leader, Kim Jong Un.
North Korea denied the accusation.
In 2013, South Korea blamed the North for crippling cyber-attacks that froze the computer systems of its banks and broadcasters for days.
New fears of attacks on South Korea's computer systems came as South Korean and US troops conducted large-scale military exercises which North Korea denounced as "nuclear war moves" and threatened to respond with an all-out military offensive.
© Thomson Reuters 2016
Catch the latest from the Consumer Electronics Show on Gadgets 360, at our CES 2026 hub.