South Korea’s Foreign Ministry has disclosed that attackers breached the Korea National Diplomatic Academy’s online education system, compromising personal data belonging to current and former ministry staff and diplomats stationed abroad.
The Korea National Diplomatic Academy launched the online training platform in 2022 to support remote learning during the COVID-19 pandemic. Since then, it has been used to deliver job training and language courses for diplomatic personnel.
According to the ministry, the intrusion started in April 2025 and continued until February 2026.
The leaked data includes usernames, names, email addresses, and encrypted passwords tied to accounts on the training platform. The ministry noted resident registration numbers, phone numbers, home addresses, and photos were not part of the leak.
The ministry has taken the affected system offline and says it is implementing additional security measures to prevent further damage.
“Please exercise special caution when receiving emails from unknown sources,” the South Korean government warned.
Those with privacy concerns are advised to reach out to the ministry’s security department.
South Korean daily Dong-A Ilbo reported that personal information belonging to about 10,000 current and former diplomats and officials seconded from other government ministries may have been compromised.
Foreign Ministry spokesperson Park Il addressed the incident during a press briefing, saying: “We recognized this issue in February, but we announced it five months later because of the sensitivity of the matter regarding our diplomatic and security affairs, and the need for careful review and analysis.”
Another official dismissed speculation that the delay was tied to unrelated diplomatic developments, saying it resulted from the technical complexity of the investigation and the need to coordinate with other government agencies.
The ministry said the attackers exploited a zero-day vulnerability. Security researchers noted that the use of zero-day exploits against third-party software is consistent with tactics previously linked to North Korean state-backed hacking groups. However, South Korean officials have not attributed the attack, adding that technical analysis remains ongoing.
