Unknown attackers maintained long-term, covert access to South Korea’s diplomatic training infrastructure for nearly ten months, exposing personal data tied to almost the entire diplomatic cadre and highlighting structural weaknesses in the Foreign Ministry’s security governance.
South Korea’s Ministry of Foreign Affairs (MoFA) has confirmed a prolonged compromise of the Korea National Diplomatic Academy (KNDA) online education system, with unauthorized access persisting from April 2025 through early February 2026.
The breached platform supports e-learning for current and former diplomats, overseas mission staff, and other Foreign Ministry personnel, effectively making it a central hub for training and credential management.
Officials estimate that up to 10,000 records were exposed, encompassing almost all serving South Korean diplomats and a substantial number of retired officials and administrative staff posted to embassies and consulates worldwide.
The attack has been described in local reporting as leveraging a likely zero-day flaw in the web-based training infrastructure, enabling persistent access and data exfiltration without triggering existing monitoring or alerting mechanisms.
Notably, the compromise was not discovered by MoFA itself; a separate “related government authority” identified abnormal activity and notified the ministry in early February 2026, prompting an emergency shutdown of the platform that same day.
The exposed dataset includes trainee IDs, names, email addresses, and encrypted passwords associated with accounts on the KNDA online education system.
Additional contextual information, such as positions and organizational affiliations within the Foreign Ministry and overseas missions, also appears to have been accessible to the attackers, potentially enabling correlation between identities and diplomatic roles.
According to MoFA disclosures, the unknown actor exploited a security vulnerability in the KNDA system to gain control over at least one server and then quietly maintained access for nearly ten months without detection.
MoFA has stressed that unique identification numbers, sensitive personal information, mobile phone numbers, home addresses and photographs were not part of the leaked dataset.
Core national security systems such as classified networks and operational diplomatic channels were not directly affected by this incident.
South Korean Diplomatic System
While attribution remains formally unresolved, the ministry has stated that it is investigating a wide spectrum of potential threat actors, explicitly including foreign state-linked hacking groups and, notably, North Korean interests.
Technical analysis to date has reportedly been insufficient to confidently link the intrusion to a specific APT or criminal group, but the targeting of a high-value diplomatic training environment.
The use of a stealthy, long-lived exploit strongly align with state-sponsored tradecraft and reconnaissance-driven objectives.
Local commentary has already framed the incident as a serious failure in MoFA’s security posture, pointing to a lack of robust vulnerability management, delayed detection and an overreliance on external authorities for incident discovery.
In response, MoFA has fully blocked access to the KNDA online education system, keeping it offline while security enhancements, forensic investigation and infrastructure hardening are conducted.
Users are being urged to treat any suspicious email referencing KNDA training or Foreign Ministry accounts with caution and to report such messages to the designated department handling the incident, given the potential for credential reuse and spear-phishing exposed IDs and email addresses.
The ministry has pledged to strengthen authentication, monitoring and vulnerability management across training platforms and to notify affected individuals.
For individuals seeking redress or advice related to personal information infringement, authorities have directed them to contact the Personal Information Dispute Mediation Committee via its official portal at kopico.go.kr, which provides mediation and support services in data breach cases.
What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist
