South Korea Korea National Diplomatic Academy Data Breach Exposes Diplomat Information via Zero-Day Vulnerability

South Korea has disclosed a significant data breach impacting the Korea National Diplomatic Academy's online education system exposing personal information of current and former Ministry of Foreign Affairs employees including overseas diplomats. The breach was facilitated by the exploitation of a previously unknown vulnerability in the Academy's server. The breach remained undetected for approximately ten months from April 2025 to expose personal information of current and former Ministry of Foreign Affairs employees including overseas diplomats. The breach was discovered by the National Intelligence Service in February 2026 after the system had been compromised via a zero-day vulnerability from April/May 2025 until February 2026. Public disclosure of the incident occurred on July 21-22, 2026, following internal review and analysis. The compromised data includes names user IDs email addresses encrypted passwords positions and departmental affiliations of up to 10,000 individuals with at least 6,000 confirmed affected and 350 being current government attachés. No sensitive identification numbers mobile phone numbers home addresses or internal government systems were compromised.