Korea National Diplomatic Academy training platform breach via zero-day

In late July 2026, South Korea's Ministry of Foreign Affairs disclosed that an unidentified attacker had maintained access to the online training platform of the Korea National Diplomatic Academy (KNDA), the ministry's diplomat-training institution, from April 2025 until February 2026. The intruder exploited a previously unknown (zero-day) software vulnerability together with security configuration weaknesses, and the breach went unnoticed for roughly ten months.

Suspicious activity was spotted in February 2026, at which point the system was taken offline. The ministry attributed the five-month gap before public disclosure to the sensitivity of the matter and the need for coordination between agencies.

What was exposed

The compromised system held user IDs, names, email addresses and encrypted passwords of current and former Foreign Ministry personnel and other government officials, with job titles and department affiliations in some records. Reporting put the number of affected people at about 6,000, including several hundred serving diplomats, from a database that may have held up to 10,000 records. The ministry said resident registration numbers, phone numbers, home addresses and photos were not compromised, and it warned staff to be careful with unsolicited emails.

Why it matters

Officials did not formally attribute the intrusion, saying technical analysis was ongoing, but authorities were examining a possible link to North Korean state-backed groups, whose tradecraft researchers said it resembled. A roster of diplomats with verified work emails and roles is a ready-made target list for spear-phishing, which makes a "low sensitivity" training platform a valuable stepping stone for espionage.