South Korea’s Ministry of Foreign Affairs has disclosed a major cyberattack affecting the Korea National Diplomatic Academy’s online education system.
Unknown attackers exploited security weaknesses and may have accessed personal data belonging to current and former diplomats, overseas mission staff, and other government personnel.
The ministry said the intrusion occurred between April 2025 and February 2026, giving the threat actor a long window to access the affected environment.
Investigators are still assessing the full scope of the incident and identifying the party responsible. The breached platform was used for online training of diplomats and public officials.
Reports indicate that the attackers exploited a zero-day vulnerability an unknown software flaw for which no patch was available at the time of compromise along with security configuration weaknesses.
Data at risk includes user IDs, names, email addresses, and encrypted passwords belonging to people enrolled in the training system.
While encrypted passwords are not immediately readable, they can still present a risk if the encryption or password-hashing implementation is weak, or if affected users reused passwords across other services.
South Korean officials said that resident registration numbers, sensitive personal information, mobile numbers, photographs, and home addresses were not included in the confirmed exposed data.
However, names, official email accounts, roles, and organizational affiliations can be highly valuable to threat actors targeting diplomatic personnel.
South Korean Diplomats’ Data Compromised
The attack reportedly continued for about 10 months before suspicious activity was reported to the ministry in February 2026.
The extended dwell time raises concerns that the attackers may have mapped internal relationships, collected data in stages, or used account details to prepare follow-on phishing operations.
Diplomats and overseas officials are attractive targets for espionage-focused threat actors.
Even limited identity data can help attackers create convincing spear-phishing lures, impersonate colleagues, or identify individuals working in sensitive departments and foreign missions.
For example, a targeted email that includes a diplomat’s name, agency affiliation, and training-platform context could appear legitimate.
An attacker could use it to deliver credential-harvesting pages, malware, or malicious document attachments. Organizations should therefore treat the breach as an ongoing identity-security risk rather than a one-time data-loss event.
The number of affected individuals remains unclear. Government and media reports refer to approximately 6,000 to 10,000 records, with some variation likely caused by duplicate accounts, former personnel records, and records from staff seconded from other agencies, mofa said.
After receiving notice of suspicious access, the Foreign Ministry blocked the online education system and introduced additional security measures.
The ministry is also investigating the breach with relevant authorities and has advised personnel to be cautious of suspicious or unverified emails.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
