Loading story…
South Korea’s Ministry of Foreign Affairs disclosed that hackers compromised the Korea National Diplomatic Academy’s e-learning platform and remained inside the system for about nine months, from April 2025 until abnormal access was detected in February 2026. The ministry said the attackers stole personal information belonging to former and current employees, including trainee IDs, names, email addresses, and encrypted passwords, before the affected system was shut down and taken offline.
South Korean officials described the incident as unprecedented, with reporting indicating the breach may have exposed the personal data of nearly all South Korean diplomatic personnel as well as up to 10,000 administrative and intelligence records. The intrusion was reportedly enabled by a previously unknown zero-day vulnerability in server software combined with misconfigured security settings, but authorities have not publicly attributed the attack to any specific threat actor.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
South Korea's Ministry of Foreign Affairs publicly disclosed the Korea National Diplomatic Academy platform breach on July 22, 2026, about five months after discovery. The ministry said exposed data included login IDs, names, email addresses, and encrypted passwords, while national ID numbers and other sensitive personal details were not affected.
South Korea's Ministry of Foreign Affairs disclosed that hackers stole personal information from the Korea National Diplomatic Academy platform, including trainee IDs, names, email addresses, and encrypted passwords. Subsequent reporting said the incident may have exposed nearly all South Korean diplomatic personnel's personal data and up to 10,000 administrative and intelligence records.
In February 2026, the Ministry of Foreign Affairs detected abnormal access to the academy's system and shut it down. The platform had not yet been restored at the time of reporting.
Unidentified attackers compromised the Korea National Diplomatic Academy's e-learning platform, beginning an intrusion that the Foreign Ministry said lasted for months. Reporting said the attackers exploited a previously unknown zero-day in server software along with misconfigured security settings.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
9 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcecyberveille.ch
Open sourceteiss.co.uk
Open sourcehelpnetsecurity.com
Open sourcemalware.news
Open sourcetherecord.media
Open sourcemofa.go.kr
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A security researcher said he infiltrated infrastructure used by North Korean hackers for 22 months and uncovered evidence tying the operation to **1,640 companies in 57 countries**, with **700 to 800 organizations** allegedly suffering serious intrusions. A WIRED report, cited in social media coverage, described the findings as showing that North Korean operators had breached hundreds of networks worldwide, while researcher **Vangelis Stykas**, CTO of Kumio, publicly identified roughly a dozen affected organizations. Among those named was **Boston Children’s Hospital**, which disputed that its own systems were compromised. The hospital said the incident involved only a former contractor’s personal device rather than a breach of hospital systems. The reporting highlights both the scale of the alleged North Korean campaign and the uncertainty that can follow public attribution, as victim organizations challenge how exposure and impact are characterized.
Aug 8, 2026
South Korea faced repeated large-scale cyberattacks that disrupted banks, broadcasters, and government-facing online services, with incidents ranging from distributed denial-of-service activity against public websites to destructive attacks that knocked out internal computer networks. In one wave, attackers targeted major South Korean institutions including a leading bank, a national newspaper, and the country’s intelligence service, while related attacks also hit U.S. government websites such as the White House, Pentagon, and State Department. Officials described those operations as primarily disruptive to public-facing services rather than breaches of internal systems. In a later major incident, computer networks at broadcasters **KBS**, **MBC**, and **YTN**, along with **Shinhan Bank** and **Nonghyup**, were crippled, interrupting ATMs, payment terminals, and mobile banking even as television broadcasts remained on air. South Korean authorities raised cyber alert levels, sent investigative teams, and increased military cyber readiness amid heightened regional tensions and longstanding concern over North Korea’s cyber capabilities, though officials said attribution remained unconfirmed and warned that identifying the true source could take months; some compromised machines reportedly displayed messages from a group calling itself **"WhoisTeam."**
Jun 29, 2026
Researchers published an investigation into suspected **DPRK-linked cryptocurrency intrusions**, outlining activity tied to crypto theft operations and the tradecraft used to compromise digital asset targets. The reporting frames the campaign as part of North Korea’s broader effort to generate revenue through cyber operations, with intrusions aimed at organizations handling cryptocurrency and related infrastructure. Separate reporting detailed an alleged **ShinyHunters** breach involving the **EU Europa platform**, claiming the exposure of roughly **90GB** of data and highlighting the potential compromise of **DKIM keys** and weaknesses in **single sign-on (SSO)** architecture. The analysis said the incident could have affected authentication and trust mechanisms tied to the platform, raising concerns about downstream abuse of exposed email-signing material and identity systems.
Jul 12, 2026