Overview
- Officials say an unidentified attacker gained control of the Korea National Diplomatic Academy’s training server in April or May 2025 and kept accessing it until the system was shut down in early February 2026.
- The compromised server held roughly 10,000 personnel records including names, user IDs, positions, email addresses and encrypted passwords, though some outlets report a lower affected total of about 6,000.
- Investigators found the intruder exploited a previously unknown zero‑day flaw in the platform’s software that the vendor later patched after the breach was discovered.
- Authorities say there is no confirmed misuse of the data and no evidence the attacker moved into the Foreign Ministry’s core networks, but attribution remains undetermined and the probe is ongoing.
- The government defended its months-long delay in public disclosure as needed to secure sensitive information, a stance that has drawn criticism and prompted promises of audits, tighter access controls and reviews of independently run government servers.