Ministry of Foreign Affairs headquarters in Seoul (Foreign Ministry) The personal information of nearly all South Korean diplomats may have been exposed after hackers gained access to an online training system used by Foreign Ministry personnel and remained inside it for about 10 months, officials said Tuesday.The breach involved an online education platform operated by the Korea National Diplomatic Academy, a ministry-affiliated institution responsible for training diplomats and conducting foreign affairs research.The compromised system contained about 10,000 personnel records, including those of serving and former diplomats, government officials posted to overseas missions and administrative staff working at South Korean embassies and consulates, a ministry official said on condition of anonymity.The figure is that of personnel records stored on the server, not the confirmed number of people whose information was taken. The ministry has not determined how many records were actually extracted.“About 10,000 sets of data were stored on the system,” the official said. “We are assuming that a significant amount was leaked, although it remains difficult to determine the exact scale.”According to the official, the records included names, user IDs, email addresses and encrypted passwords, along with information about the individuals’ positions and affiliations. The ministry said it could not confirm the number of affected people as one person may have appeared more than once or held multiple accounts.The available logs also did not show whether the attacker had accessed or extracted every record stored on the server, the ministry added.10-month breachThe ministry first disclosed the incident Monday, saying an unidentified attacker had gained control of the system’s server around April or May 2025 and continued accessing it until early February.At Tuesday’s briefing, the ministry released additional details about the size of the database, the information stored on it and the groups of government personnel who may have been affected.According to the ministry statement from Monday, officials became aware of suspicious activity only after another government agency alerted them in early February. The ministry then shut down the system and began a joint investigation.The attacker accessed the server repeatedly during that period, the official said, without disclosing the number of connections or further technical details.The system was launched in 2022 as the COVID-19 pandemic increased demand for online training. Many ministry employees were automatically registered, while some users created accounts themselves. The database also included officials dispatched to overseas missions from other government ministries and agencies.Asked whether personnel from intelligence or security agencies posted abroad may have been included, the official declined to comment.“Details about the composition and staffing of overseas missions have national security implications,” the official said.According to the ministry, the server did not contain resident registration numbers, telephone numbers, home addresses, photographs or government employee identification numbers. It also said the training system was separated from the ministry’s internal network, passport system and other government networks. The ministry has found no indication that the attacker used the compromised server to gain direct access to those systems.The attacker exploited a previously unknown security flaw, known as a zero-day vulnerability, in software used by the platform, according to the ministry.The software manufacturer was itself unaware of the vulnerability when the intrusion began. The flaw was identified during the investigation, after which the manufacturer released a security patch.The ministry said the platform had undergone security checks before its launch and in subsequent years, including several reviews in 2025.It argued that the vulnerability could not have been detected through conventional inspections because neither the manufacturer nor security authorities knew it existed at the time.Attacker unidentifiedAsked whether North Korea may have been responsible, the official said investigators lacked sufficient technical evidence to attribute the attack to a particular country or organization.“There is not yet enough technical analysis to determine the perpetrator,” the official said. “We are not ruling out any possibility, including hacking organizations backed by foreign states.”The ministry attributed the delay in disclosing the breach to difficulties in analyzing the infected server and the need for caution, as the incident involved a large amount of personnel information with possible national security implications.Those whose information may have been exposed have not yet been notified individually.The ministry said it was preparing to contact people through the email addresses stored on the system. It acknowledged, however, that some addresses were no longer in use and that former employees whose government accounts had expired could be difficult to reach.The training system remains offline, and the ministry has not decided when or whether it will resume operations.