Hackers accessed data of 10,000 Korean diplomats for nearly a year

Hackers are believed to have accessed the personal information of as many as 10,000 individuals from the online educational server of the Korea National Diplomatic Academy (KNDA) for nearly a year. The Ministry of Foreign Affairs, which operates the academy, failed to detect the hack while it was underway, raising concerns about its cybersecurity capabilities. Critics also say the ministry waited too long to notify employees about the leak.

“

There were around 10,000 records saved on the server.

The Foreign Ministry launched an investigation into the hack of the KNDA online education system, which lasted 10 months from April 2025 to early February 2026. This followed notification from another government body in February. Data on the server included names, user IDs, email addresses, and encrypted passwords of individuals trained at the KNDA. The leaked records may include not only all diplomats working at ministry headquarters and overseas but also agents from the National Intelligence Service and military attachés from the Ministry of National Defense who received training before overseas assignments.

“

not unrelated to national security.

"There were around 10,000 records saved on the server," a Foreign Ministry official said. The official described the leak as "unprecedented" and admitted it was "not unrelated to national security." While investigators are considering the possibility of state-backed actors, including North Korea or China, the ministry has not disclosed who orchestrated the attack. "At the present, our technical analysis hasn’t reached the point where we can assign responsibility. We’re open to all possibilities, including hacking organizations backed by other countries," a ministry official stated.

“

At the present, our technical analysis hasn’t reached the point where we can assign responsibility. We’re open to all possibilities, including hacking organizations backed by other countries.

Concerns are high that sensitive information about diplomats could be exploited for malicious purposes. The hacked system was initially brought online in 2022 when in-person training was not feasible due to the pandemic. Although the ministry periodically assessed the system's cybersecurity, it remained unaware of this attack until being notified in early February. The ministry official explained, "This attack was carried out with standard software authorization after accessing the system using a zero-day vulnerability, a weakness that software developers weren’t aware of. That made it difficult to detect using ordinary means." However, even with novel techniques, the ministry faces criticism for failing to detect the attack for 10 months and for inadequate precautions despite handling sensitive national security data. The ministry has yet to determine the full extent of the damage or how many records were leaked.

“

This attack was carried out with standard software authorization after accessing the system using a zero-day vulnerability, a weakness that software developers weren’t aware of. That made it difficult to detect using ordinary means.