S. Korea Probes Diplomatic Academy Hack, N. Korea Eyed
Get the Geopolitics newsletter
Daily geopolitics — wars, elections, sanctions, the diplomatic moves that move markets. Free.
- South Korea's Foreign Ministry disclosed a "significant" data breach at the Korea National Diplomatic Academy, with spokesperson Park Il calling the leak of "considerable scale."
- Attackers exploited a previously unknown "zero-day" software vulnerability and security configuration weaknesses to gain server control between April and May 2025, maintaining access undetected until February 2026 — a roughly 10-month dwell time.
- The compromised online education system stored training videos, course administration data, participants' names, and user IDs, though the ministry said it remains difficult to determine exactly what data was leaked.
- Dong-A Ilbo, citing government sources, reported that personal information belonging to approximately 6,000 current and former diplomats and officials seconded from other ministries may have been compromised, including data on diplomats stationed overseas.
- Intelligence authorities are investigating whether a North Korean-linked hacking group carried out the attack, though the ministry stressed there is currently insufficient technical evidence to attribute it to any specific actor.
- No misuse of leaked data has been confirmed, and Park Il said the ministry was working with relevant agencies to determine the full extent of the breach and strengthen internal cybersecurity, while not ruling out any foreign-based hacking groups.
Why it matters: The roughly 10-month dwell time and targeting of a diplomatic training platform suggest a patient, state-level adversary focused on intelligence collection rather than disruption. If North Korean links are confirmed, data on approximately 6,000 diplomats — including those posted overseas — would give Pyongyang granular insight into South Korea's foreign service personnel and postings.
