Contained Medium impact Data breach Checked 19h ago

South Korea diplomatic academy hacked for 10 months

Hackers entered the Korea National Diplomatic Academy's online education system through a previously unknown software flaw and remained inside for nearly ten months. Names, user IDs, emails and encrypted passwords were exposed. The platform remains offline while police and South Korea's privacy regulator investigate. Reporting in mid-to-late August found the hacked system had never been enrolled in the government's round-the-clock security monitoring, which the Foreign Ministry says it is now fixing, and South Korean security authorities continue to suspect North Korea was behind the intrusion, though this has not been officially confirmed. On September 1, 2026, the Foreign Ministry proposed quadrupling its cyber security budget for next year in direct response to the hack.

Started
Apr 1, 2025
Latest activity
Sep 1, 2026
Attributed to
Not named publiclySuspected
Where
South Korea
Sectors
Government
Scale
one government agency, the Korea National Diplomatic Academy, affecting roughly 6,000 to 10,000 current and former Foreign Ministry staff

Current status

On September 11, 2026, Weekly Chosun reported that records of about 600 National Intelligence Service overseas personnel may also have been stored in the hacked system, but this was not confirmed.

Contained: The attack has been stopped or blocked. Recovery and investigation are still running.

Who is behind it

South Korean authorities said they are examining a possible North Korea connection but have not named a confirmed attacker.

Impact

Attackers exploited a previously unknown flaw in the academy's online education system and had access from around April 2025 to February 2026. Personal data including names, user IDs, emails and encrypted passwords tied to up to 10,000 records was exposed, and the platform was taken down. About 5,800 affected people were emailed directly. Roughly 4,200 were covered only by a public website notice because the academy said it lacked email or phone details. On August 18-19, 2026, it emerged that the breached system had been left out of the ministry's 24-hour real-time security monitoring, which lawmakers say let the intrusion continue undetected for months. On August 21, 2026, South Korean security authorities were reported to suspect North Korea's involvement, without official confirmation.

What to do

Affected government staff should not assume that receiving no email means they were unaffected. They should check the Foreign Ministry's public breach notice, follow its guidance on password and email changes, and watch for further notices.

Timeline

  1. Sep 11, 2026

    Weekly Chosun reported that records of about 600 National Intelligence Service overseas personnel may have been included in the hacked system. The possible exposure was not confirmed, and no restoration or investigation closure was reported.

    Containedweekly.chosun.com
  2. Sep 1, 2026

    Yonhap reported the Foreign Ministry's proposed 2027 budget raises its cyber security spending from 3.8 billion won to 15.5 billion won, more than four times, citing the diplomatic academy hack as the reason for strengthening security monitoring and information protection systems.

    Containedfnnews.com
  3. Aug 21, 2026

    The Dong-A Ilbo reported that South Korean security authorities suspect North Korea was behind the Diplomatic Academy's security software server breach, in a report primarily about a separate suspected Lazarus group hack of a private certification firm that exposed data tied to former presidential office staff.

    Containeddonga.com
  4. Aug 19, 2026

    Foreign Minister Cho Hyun told the National Assembly's Foreign Affairs and Unification Committee that the ministry takes the monitoring lapse seriously and is moving quickly on defensive measures.

    Containednews.kbs.co.kr
  5. Aug 18, 2026

    KBS reported that the hacked online education system had never been enrolled in the Foreign Ministry's 24-hour real-time security monitoring, despite government guidelines requiring it.

    Containednews.kbs.co.kr
  6. Aug 7, 2026

    Sisa Journal reported that the Foreign Ministry emailed about 5,800 of roughly 10,000 affected people. About 4,200 others were not individually notified because the academy said it lacked contact details. The attacker and exact data loss remained unconfirmed.

    Containedsisajournal.com
  7. Aug 3, 2026

    South Korea's privacy regulator said it was checking whether the Foreign Ministry's five-month delay in reporting the breach and notifying affected people violated privacy law.

    Containedhani.co.kr
  8. Jul 29, 2026

    South Korea's National Office of Investigation formally opened a police probe into the hack, saying it is examining the possibility that North Korea or China was behind the intrusion.

    Containedchosun.com
  9. Jul 24, 2026

    South Korean authorities said they are investigating a possible North Korea link while police continue their probe.

    Containedyahoo.com
  10. Jul 23, 2026

    The Foreign Ministry said it plans to change all affected diplomats' email addresses to prevent misuse of the leaked data.

    Containedmsn.com
  11. Jul 22, 2026

    The Foreign Ministry confirmed the breach affected current and former staff and overseas diplomats and said the platform was taken offline.

    Containedbleepingcomputer.com
  12. Jul 21, 2026

    South Korean media reported the National Diplomatic Academy's online education system was hacked and undetected for about 10 months, exposing up to 10,000 records.

    Emergingchosun.com

Sources

Related reports