South Korea has confirmed a major data breach targeting the online training system of the Korea National Diplomatic Academy, resulting in the disclosure of personal information belonging to diplomats and Ministry of Foreign Affairs staff after exploitation of a zero‑day vulnerability. The intrusion went undetected for roughly ten months, from April/May 2025 until February 2026, and affected up to 10,000 records — at least 6,000 of which have been confirmed — including 350 attachés posted overseas. The incident did not, however, expose national ID numbers or other sensitive government systems.
Key topics
– Who and what was affected
– How the attack unfolded
– Authorities’ response and recommended measures
Summary and available technical details help assess the scope and immediate risks to those affected; the official investigation remains ongoing.
Scope of the compromise
The affected database contained personally identifiable information such as names, user IDs, email addresses, hashed passwords, job titles and departmental attachments. No national registry numbers, mobile phone numbers, home addresses, photographs or administrative identifiers were stored on the compromised server. The targeted system — deployed in 2022 for distance learning and videoconferencing — was internet‑facing and held profiles for diplomats, administrative staff and personnel from other agencies assigned abroad.
The vulnerability and modus operandi
Investigators determined the initial intrusion exploited a zero‑day vulnerability in the educational platform’s software — a flaw unknown to the vendor and authorities at the time. The attacker maintained persistent, undetected access for nearly ten months. The compromised server was hosted at the Ministry of Foreign Affairs headquarters and, according to authorities, had been excluded from routine security checks, which contributed to the prolonged intrusion. Published technical materials do not identify any specific publicly attributable tools, malware or infrastructure, and there is currently no evidence of lateral movement into other sensitive ministry networks.
Risks and implications for diplomatic personnel
Although exposed data did not include sensitive government identifiers, access to names, emails, roles and attachments increases the risk of targeted operations such as spear‑phishing, identity fraud and social‑engineering campaigns against diplomats and their contacts. Authorities emphasized that the server was isolated from the ministry’s internal network, the passport system and other sensitive infrastructure, and there is no proof to date that those systems were accessed.
Discovery, investigation and transparency
The compromise was detected in early February 2026 by the national intelligence service, which alerted the Ministry of Foreign Affairs. The ministry took the platform offline and launched a joint investigation. Public disclosure occurred on 21–22 July 2026, following an internal period of analysis and coordination. As of the publication of the report, no technical indicators or attribution to a specific actor had been released publicly; all possibilities, including the involvement of a state‑sponsored actor, remain under review.
Tactical mapping and limits of the analysis
The available evidence aligns with techniques cataloged in MITRE ATT&CK, notably exploitation of a publicly exposed application for initial access (T1190) and collection from information repositories (T1213). Exact exfiltration methods have not been publicly confirmed, and the absence of details about tools or infrastructure prevents reliable attribution. Authorities report use of a zero‑day and an attack profile consistent with APT activity, but they have not publicly linked the incident to any known group.
Actions taken and recommendations
Actions already taken or recommended include: immediate takedown and isolation of the compromised system; deployment of vendor patches to remediate the zero‑day; a full forensic investigation and log review to determine the precise scope; notification and support for potentially affected individuals, with advice to monitor for suspicious communications; and strengthening audits and security controls. The ministry’s investigation and coordination with national cyber authorities continue.
