South Korea’s Foreign Ministry announced Tuesday that a cyberattack on a government-operated diplomatic training institution appears to have resulted in the exposure of a “considerable” amount of sensitive data, as investigators look into whether foreign state-sponsored hackers may be responsible.
Ministry spokesperson Park Il addressed reporters at a briefing, saying early findings point to a data leak of significant size. However, he noted that officials have not yet been able to determine exactly how much information was compromised or precisely what data was affected.
Park added that there is no confirmed evidence of the leaked data being misused, and that investigators currently lack sufficient technical proof to identify the attackers. He said the government is keeping all possibilities on the table, including involvement by hacking groups operating out of foreign countries.
His remarks came after the ministry released a statement Monday revealing that unknown attackers had taken advantage of a previously undiscovered “zero-day” software flaw, along with weaknesses in security configurations, to break into the online education system of the Korea National Diplomatic Academy.
According to the ministry, the attackers gained control of a server sometime between April and May 2025 and maintained that access until February 2026, when a government agency flagged suspicious activity and the system was shut down.
The ministry said the compromised system contained training videos and administrative course information, including participants’ names and user IDs. Officials acknowledged it remains difficult to pinpoint exactly what data was taken.
South Korean newspaper Dong-A Ilbo, citing government sources, reported that personal information belonging to roughly 6,000 current and former diplomats and officials on loan from other government agencies may have been exposed. The report indicated that intelligence authorities are looking into whether a hacking group with ties to North Korea may have targeted the data, which reportedly includes information on diplomats serving at overseas posts.
Spokesperson Park said the ministry is coordinating closely with relevant agencies to fully assess the scope of the breach and to bolster its internal cybersecurity measures going forward.
