Breach at South Korea's Diplomatic Academy: Diplomats' Data at Risk Worldwide

South Korea has officially acknowledged a data breach in the distance-learning system of its National Diplomatic Academy. An unidentified attacker exploited a vulnerability on the academy's server and, over the course of ten months, had access to the personal data of Ministry of Foreign Affairs staff.

What happened

The intrusion took place in April 2025, and data was being exfiltrated from April 2025 through February 2026. At least 6,000 people were affected — current and former employees of the ministry's central office and of overseas missions. Among them were roughly 350 serving attachés posted abroad. According to Korean media, the number of those affected may reach 10,000, and official positions along with the departments they belonged to were also exposed.

The learning platform was launched in 2022 for distance education during the COVID-19 pandemic and has since been used to train civil servants and to host video conferences.

What data was leaked

By the ministry's assessment, the compromised information includes the IDs, names, email addresses and encrypted passwords of registered users. The Foreign Ministry stresses that unique identification numbers, sensitive information, mobile phone numbers, photographs and home addresses were not affected.

Access to the system has been blocked and additional protective measures have been put in place. Potential victims have been advised to treat emails from unclear or unknown sources with particular caution and to report any suspicious messages to the ministry's security service.

Why they stayed silent for five months

The breach was discovered in February 2026 by the National Intelligence Service, which then notified the Foreign Ministry. The incident was only made public five months later. Ministry spokesman Park Il explained the delay by citing the sensitivity of a subject that touches on diplomatic and security matters, as well as the need for a thorough analysis.

The reason the attack went unnoticed for so long deserves a separate mention: the compromised server sat inside the Foreign Ministry's headquarters and, for that very reason, had been left outside the scope of routine security monitoring. In other words, an asset within the guarded perimeter was deemed sufficiently protected simply by virtue of its location — and that is precisely what became the weak link.

Source: Bleeping Computer