South Korea Reports Data Breach Affecting Diplomats Worldwide
South Korea has disclosed a data breach involving its National Diplomatic Academy's online education system, which has affected around 6,000 individuals, including 350 current diplomats. The breach occurred over a ten-month period, beginning in April 2025, when an unknown hacker exploited a vulnerability in the Academy's server. The education platform, established in 2022 to facilitate remote training during the COVID-19 pandemic, has been utilized for training government personnel and conducting video conferences.
The South Korean government announced that personal information, including IDs, names, email addresses, and encrypted passwords of individuals enrolled in the education system, was leaked between April 2025 and February 2026. However, the Ministry of Foreign Affairs (MFA) clarified that no unique identification numbers, sensitive information, mobile phone numbers, photographs, or home addresses were compromised in the incident.
In response to the breach, the MFA has blocked access to the online education system and implemented additional security measures. During a press briefing, MFA spokesperson Park Il explained that the ministry delayed the announcement of the breach due to its sensitive nature and the need for a thorough analysis before making it public. The breach was recognized in February 2026, but the announcement was made five months later to ensure a careful review of the situation.
Potentially affected individuals have been advised to remain vigilant for any suspicious communications and to report them to the ministry’s security department. The MFA has urged caution when receiving emails from unknown sources. While Korean media reports suggest that the number of affected individuals may be as high as 10,000, the MFA has not confirmed this figure. Reports indicate that official job titles and departmental affiliations were also exposed during the breach.
One factor contributing to the prolonged undetection of the breach was that the compromised server was located within the MFA's headquarters and was not subjected to regular security scrutiny. The breach was ultimately discovered by the National Intelligence Service in February 2026, which subsequently alerted the MFA about the compromise. This incident highlights ongoing vulnerabilities in cybersecurity, particularly within sensitive government systems.
