South Korea Diplomatic Academy Cyberattack Exposes Data of Thousands of Diplomats

South Korea's Foreign Affairs Ministry confirmed that a zero‑day vulnerability was used to infiltrate the online education platform of the Korea National Diplomatic Academy (KNDA). Attackers gained control of a server between April and May 2025 and remained inside until the breach was detected in February 2026.

The compromised system stored training videos and administrative data for roughly 6,000 current and former diplomats and other officials. Leaked information includes names, user IDs, email addresses and encrypted passwords; more sensitive data such as national ID numbers, phone numbers or home addresses were reportedly not affected. The ministry said a "significant" amount of data appeared to have been exposed and noted no evidence of misuse so far.

Investigators are probing whether a North Korean‑linked hacking group may be responsible, but the identity of the attackers has not been confirmed. Authorities are working with relevant agencies to assess the full scope of the breach and to strengthen cybersecurity measures for diplomatic personnel.