The **National Diplomatic Academy** in South Korea has confirmed a major data breach affecting its online education system. The incident, which began in April 2025 and continued until February 2026, saw an unknown threat actor exploit a vulnerability in the Academy's server. This prolonged access led to the compromise of personal information belonging to at least 6,000 individuals associated with the **Ministry of Foreign Affairs** (**MFA**), including approximately 350 current government attachés serving abroad. ### Origins of the Compromise The online education platform was initially established in 2022 to facilitate remote training during the COVID-19 pandemic. It has since been utilized for various government personnel training programs and video-conferencing. Reports suggest that one critical factor contributing to the breach's long duration was the compromised server's location within **MFA** headquarters, which reportedly excluded it from standard security scrutiny. The breach was ultimately discovered in February 2026 by the country's **National Intelligence Service**, which then alerted the **MFA**. ### Data Exposed and Delayed Disclosure The leaked data is believed to include individuals' IDs, names, email addresses, and encrypted passwords. The **MFA** has stated that no unique identification numbers, sensitive personal information, mobile phone numbers, photographs, or home addresses were compromised. However, some Korean media outlets have reported that the number of affected individuals could be as high as 10,000, with official job titles and departmental affiliations also exposed. The Ministry acknowledged the issue in February but delayed public disclosure for five months. An **MFA** spokesperson, **Park Il**, cited the sensitive nature of the matter, particularly concerning diplomatic and security affairs, and the need for thorough review and analysis as reasons for the delay. ### Mitigation and Recommendations In response to the breach, the **MFA** has blocked access to the online education system and implemented enhanced security measures. Potentially impacted individuals have been advised to remain vigilant for suspicious communications. The **MFA** specifically warned against emails from unclear or unknown sources, urging recipients to report any such communications immediately to the ministry's security department.