South Korea disclosed that hackers breached the National Diplomatic Academy’s online education system for ten months and stole personal information belonging to current and former employees of the Ministry of Foreign Affairs (MFA), including overseas diplomats.
The incident occurred in April 2025 after an unknown threat actor exploited a vulnerability in the Academy’s server. It impacts at least 6,000 individuals, 350 of them being current government attachés dispatched abroad.
The education platform was set up in 2022 to support remote training during the COVID-19 pandemic, and has since been used for government personnel training and video-conferencing.
Ten-month hacker access
According to the announcement, data was leaked between April 2025 and February 2026.
“The personal information of current and former employees of the Ministry of Foreign Affairs headquarters and overseas missions, as well as other personnel, was leaked between April 2025 and February 2026,” the South Korean government says.
It is estimated that the leaked information includes the IDs, names, email addresses, and encrypted passwords of individuals enrolled in the education system.
MFA says that no unique identification numbers, sensitive information, mobile phone numbers, photographs, or home addresses were exposed in the incident.
The ministry has blocked access to the online education system and implemented additional measures designed to strengthen security.
During a press briefing today, an MFA spokesperson said the Ministry delayed disclosing the incident because of its sensitive nature and the need to thoroughly analyze and review the matter before making it public.
“We recognized this issue in February, but we announced it five months later because of the sensitivity of the matter regarding our diplomatic and security affairs, and the need for careful review and analysis” – South Korea Foreign Ministry’s spokesperson Park Il.
Potentially impacted individuals are advised to watch for suspicious communications and report them immediately to the ministry’s security department.
“Please exercise particular caution when receiving emails from unclear or unknown sources,” MFA warns.
Korean media has reported that the number of affected individuals may be as high as 10,000, while other sources report a lower number. They also noted that official job titles and departmental affiliations were exposed.
One reason for the hack to remain undetected for this long was reportedly because the compromised server was located inside MFA’s headquarters and was excluded from regular security scrutiny.
The same reports mention that the breach was discovered in February 2026 by the country’s National Intelligence Service, which alerted the MFA of the compromise.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
