South Korea is investigating a potential connection to North Korea in the cyberattack on a diplomat training institute
South Korea is looking into a significant data breach at a diplomatic academy, with authorities probing potential links to North Korea.
South Korea is looking into a significant cyberattack aimed at its state-run diplomatic academy, following revelations that a considerable amount of data might have been compromised. Authorities are exploring potential connections to foreign state-backed hacking groups.
Foreign Ministry spokesperson Park Il stated that preliminary findings indicate the breach has revealed a significant amount of data. However, investigators are currently evaluating the full extent of the breach and the specific information that has been affected.
Park stated that officials have discovered no indications of the compromised data being misused. He noted that investigators have not yet identified those responsible, but all possibilities are being considered, including the potential involvement of foreign state-backed hacking groups.
The ministry said that the attackers used a hidden software problem, known as a zero-day vulnerability, along with weaknesses in the system’s security setup to break into the Korea National Diplomatic Academy’s online learning platform.
Officials reported that the hackers infiltrated one of the academy’s servers from April to May 2025 and went unnoticed until February 2026, when a government agency detected suspicious activity, leading authorities to intervene and block the intrusion.
The platform in question contained training materials and records for course administration, which included the names of participants and their user identification details. Officials indicated that it is still uncertain what information might have been accessed or extracted.
According to a report from the local newspaper Dong-A Ilbo, referencing government sources, there is a possibility that the personal information of approximately 6,000 current and former diplomats, as well as officials seconded from other ministries, has been compromised.
The report indicated that intelligence agencies are examining whether the cyberattack was executed by a hacking group associated with North Korea, given that the database included information pertaining to diplomats stationed abroad.
Park stated that the Foreign Ministry is working in conjunction with pertinent government agencies to assess the extent of the cyberattack and enhance cybersecurity measures to protect against future threats.
