Hackers Steal 10,000 South Korean Diplomat Records

The Ministry of Foreign Affairs of the Republic of Korea announced that an unidentified attacker compromised an online education platform operated by the Korea National Diplomatic Academy. The breach occurred between April or May 2025 and February 2026, during which time attackers exploited a zero-day software vulnerability and security configuration weaknesses to maintain server control.

Approximately 10,000 personnel records belonging to current and former South Korean diplomats, administrative staff, and government officials in overseas missions were exposed. The stolen data includes names, user IDs, email addresses, encrypted passwords, and organizational affiliations. The ministry clarified that sensitive information, such as resident registration numbers and home addresses, remained secure, and internal passport systems were not affected.

Government authorities shut down the system in early February after detecting suspicious access. While officials have not yet confirmed any misuse of the leaked data, the investigation is considering the involvement of foreign hacking organizations, including groups linked to North Korea or China. Technical evidence has not yet been sufficient to attribute the attack to a specific perpetrator.