South Korean Ministry of Foreign Affairs 2025–2026 Data Breach

The target was the online education system of the Korea National Diplomatic Academy, an institution affiliated with the Ministry of Foreign Affairs. The platform was established for remote training in 2022 and later used for government-personnel education and video conferencing. The official notice says an unidentified attack exploited a vulnerability and produced evidence of leakage involving headquarters staff, overseas missions, former employees, and other personnel.

The directly confirmed data categories are user IDs, names, email addresses, and encrypted passwords. “Encrypted” does not mean that passwords were disclosed as plaintext.

The ministry placed the leakage period between April 2025 and February 2026 without publishing an exact first-access day. This is not a claim that the actor entered on that precise day; it is the narrowest public starting boundary. News reporting says access continued intermittently for roughly ten months.

According to the reports, South Korea's National Intelligence Service detected unusual activity in February 2026, alerted the ministry, and the system was shut down. The ministry disclosed the event publicly in July. Spokesperson Park Il said diplomatic and security sensitivity and the need for careful analysis accounted for the five-month delay. Detection, technical review, and public notification are therefore separate stages.

BleepingComputer reported that at least 6,000 people were affected, including 350 current government attachés posted abroad. Korea JoongAng Daily, citing officials, described an inventory of approximately 10,000 data entries. That report explicitly warns that 10,000 is not a confirmed unique-person count because the data may include duplicate entries and retained records for former personnel.

Those measurements are not directly equivalent: one is a person estimate, while the other is a non-de-duplicated record inventory. The ministry's official web notice provides no exact total. The organization did not publish a verifiable affected-person or record total. An undisclosed count does not mean the incident had no impact; it means the public sources do not provide a reliable total. Zero does not mean nobody was affected.

A combination of user ID, name, and email address can support convincing phishing messages tailored to a person's institutional role. Encrypted password data may be subjected to offline guessing depending on the algorithm and password strength. The finding that passwords were not plaintext therefore does not eliminate risk. Reuse of the same password on another system could increase the chance of secondary account compromise.

The ministry said unique identification numbers, sensitive information, mobile phone numbers, home addresses, and photographs were not included. Those exclusions are reflected in the record. Because reporting places active diplomats and overseas missions within scope, the leak could support role-focused social engineering or personnel mapping; however, no public evidence confirms that the actor used the data for those purposes.

The Ministry of Foreign Affairs blocked access to the online education system and said it implemented additional security-strengthening measures. Korea JoongAng Daily reported that personnel temporarily had to use in-person training or a separate government video-conferencing service. Technical analysis and work to identify the attacker were continuing at the time of public disclosure.

The ministry did not attribute the attack to a state or named group. Although some analysts said the method resembled tactics used by state-backed actors, the spokesperson said there was not yet enough technical analysis to identify the culprit and no possibility had been excluded.

The ministry advised particular caution with emails from unclear or unknown sources and recommended reporting suspicious communications to its security department. Affected users can replace the education-system password and any identical or similar password elsewhere with unique strong credentials, terminate existing sessions, and enable multi-factor authentication where supported. Password-reset links should be opened only through known official channels.

Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope. The verified outcome is vulnerability exploitation from April 2025 through February 2026, exposure of IDs, names, emails, and encrypted passwords, and shutdown of the online system. The exact person count, actor, vulnerability details, and subsequent use of the data remain undisclosed.