South Korea warns diplomats they could be at risk after attack on education system

South Korean government reveals ten-month cyberattack on National Diplomatic Academy online education system
The stolen data included user IDs, names, emails and encrypted passwords of at least 6,000 people.
MFA shut down IT systems, implemented enhanced security and delayed disclosure due to diplomatic sensitivity

Cybercriminals may have siphoned data from current and former South Korean Ministry of Foreign Affairs (MFA) employees, as well as other government personnel, in an attack that lasted ten months.

The South Korean government has revealed an attack on the online education system of its National Diplomatic Academy. The system, created in 2022 by the country’s main institution for educating and training diplomats, apparently contained a security vulnerability that anonymous threat actors managed to exploit.

In an announcement posted on the official South Korean government website, neither details about the flaw nor the attackers were revealed.

Thousands affected

However, he noted that the attack took place between April 2025 and February 2026. During these ten months, cybercriminals were able to steal user IDs, names, emails, and encrypted passwords of students in the National Diplomatic Academy Online Education System.

Unique identifying information, sensitive information, mobile phone numbers, home addresses and photographs were not compromised, it said.

In response to the attack, MFA shut down its entire IT infrastructure and deployed “enhanced security measures,” without elaborating on what these measures were. He urged all employees to remain alert to incoming emails and to reach out if they receive anything “suspicious.”

Although the official announcement lacks details, beepcomputer reported that the attack affected “at least 6,000 people, 350 of them current government attachés sent abroad.” Citing an MFA spokesperson, the publication said the ministry decided to reveal the incident with a five-month delay due to the “sensitive nature” of the attack and the need to thoroughly analyze it before making it public.

“We acknowledged this matter in February, but announced it five months later due to the sensitivity of the matter with respect to our diplomatic and security affairs, and the need for careful review and analysis,” South Korean Foreign Ministry spokesman Park Il said.

Through beepcomputer