Hackers Breach South Korea’s Diplomatic Academy, Exposing Foreign Ministry Staff Data

Key Takeaways

• A prolonged breach of the Korea National Diplomatic Academy’s online education platform exposed personal data for thousands of South Korean diplomatic staff.
• The attackers maintained access for approximately ten months, from April 2025 to February 2026, exploiting a server-side vulnerability.
• Exposed data includes user IDs, names, email addresses, encrypted passwords, job titles, and departmental affiliations, impacting current and former Ministry of Foreign Affairs personnel globally.
• While no national ID numbers or highly sensitive personal information were leaked, the compromised data could facilitate sophisticated spear phishing, credential stuffing, and espionage operations.
• The Ministry of Foreign Affairs has shut down the affected system, initiated an investigation, and is notifying impacted individuals.

South Korea’s diplomatic sector is grappling with a significant cybersecurity incident following a breach of the Korea National Diplomatic Academy’s online education system. This intrusion led to the exposure of sensitive personal information belonging to thousands of current and former staff within the Ministry of Foreign Affairs, including those serving overseas.

The attack, which remained undetected for an extended period, allowed malicious actors to systematically gather data on diplomatic personnel worldwide. This extensive data compromise raises serious concerns regarding its potential exploitation for targeted attacks, espionage activities, or other forms of malicious engagement against South Korean diplomats.

Details of the Compromise

The breach originated from an unpatched security flaw within the Academy’s online education platform, a system managed under the direct purview of South Korea’s Ministry of Foreign Affairs. Official statements and local news outlets indicate that the attackers maintained unauthorized access for roughly ten months, from April 2025 to February 2026, before the compromise was finally detected and addressed.

During this prolonged period, the compromised system housed approximately ten thousand records. These records pertained to both retired foreign ministry staff and officials currently assigned to diplomatic missions abroad, underscoring the broad impact of the data exfiltration.

Analysts from the Diplomatic Information Security Office said in a report, shared with Cyber Security News (CSN), that the incident highlights how administrative and training systems, often considered less critical than core operational networks, can become prime targets for sophisticated threat actors when fundamental security protocols are neglected. While specifics of the attack technique remain undisclosed, officials have confirmed that a server-side vulnerability was exploited to establish persistent access and extract user data.

Exposed Data and Potential Risks

The information confirmed as exposed includes user IDs, full names, email addresses, encrypted passwords, job titles, and departmental affiliations for individuals registered in the Academy’s online education program. Authorities have clarified that highly sensitive personal identifiers such as national identification numbers, mobile phone numbers, home addresses, or photographs were not compromised, mitigating the immediate risk of direct identity theft.

However, even without these highly sensitive fields, the combination of professional contact details and role information provides a robust foundation for attackers to mount credible spear phishing campaigns, execute password guessing attacks, or conduct targeted social engineering efforts against diplomats and their support staff. Such data sets are invaluable for intelligence operations, as observed in previous campaigns where Russian hackers targeted diplomatic organizations across Europe, America, and Asia. These incidents demonstrate how seemingly innocuous data can be leveraged to facilitate broader intelligence gathering and influence operations.

Attribution and Response

While South Korean authorities have not yet formally attributed the attack, they are exploring all possibilities, including the involvement of state-sponsored groups, with particular attention to potential North Korean actors. This aligns with past intelligence on North Korean hackers exploiting cloud services to deploy malware and their known interest in government and diplomatic networks.

The targeting of an educational platform mirrors tactics employed by other advanced persistent threat (APT) groups, such as Turla, which has attacked European Ministries of Foreign Affairs by initially compromising peripheral systems to establish a foothold within the broader network. This strategy allows attackers to gain initial access before attempting to move laterally to more sensitive systems.

In response to the breach, the Ministry of Foreign Affairs has taken immediate action, completely shutting down the affected online education system. Additional security measures have been implemented to reinforce the platform’s defenses. An ongoing investigation is underway in collaboration with relevant authorities to fully understand the scope of the incident, assess whether any national security information was compromised, and determine when or if the system can be safely reinstated. The ministry has also commenced the process of notifying all affected individuals, a critical step in enabling staff to identify and report suspicious communications or password-related alerts.

The Diplomatic Information Security Office has issued strong advisories to current and former employees, urging heightened vigilance against suspicious emails and encouraging immediate reporting of any unusual messages related to the incident. Furthermore, staff who suspect their data may have been misused are directed to seek assistance from the Personal Information Dispute Mediation Committee via kopico.go.kr.

This incident serves as a stark reminder for foreign ministries globally to critically evaluate the security posture of all ancillary systems, including online learning portals and document sharing platforms. Such systems, if overlooked, can become vulnerable entry points for sophisticated adversaries seeking to compromise core diplomatic networks and sensitive information.

What You Should Do

• Change Passwords: All individuals who were registered on the Korea National Diplomatic Academy’s online education system should immediately change their passwords for that platform and any other accounts where they may have reused the same credentials.
• Enable Multi-Factor Authentication (MFA): Implement MFA on all critical accounts, especially those related to professional or personal email, social media, and financial services, to add an extra layer of security.
• Exercise Caution with Emails: Be extremely wary of unsolicited emails, particularly those referencing training courses, diplomatic postings, or internal programs. Verify the sender and content before clicking links or downloading attachments. Report any suspicious emails to the Diplomatic Information Security Office at 02-2100-7189.
• Monitor for Suspicious Activity: Regularly review account activity for any unauthorized access or unusual behavior.
• Consult for Data Misuse: If you believe your personal data has been misused as a result of this breach, contact the Personal Information Dispute Mediation Committee via kopico.go.kr for guidance and support.
• Review Organizational Security: Organizations, especially those in diplomatic or government sectors, should conduct thorough security audits of all their external-facing and ancillary systems to identify and patch vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.