Seen is the campus of the Korea National Diplomatic Academy, Seoul, Tuesday. Yonhap

A data breach exposed the personal information of up to 10,000 diplomats and government officials for nearly 10 months after suspected hackers broke into an online education system operated by Ministry of Foreign Affairs in April 2025, exposing what amounts to a near-complete list of ministry personnel for the first time.

The ministry disclosed the breach Tuesday, more than five months after first detecting it, and is now investigating with relevant authorities to determine whether the attack targeted national security information.

“It is assumed that hackers accessed the online system between April 2025 and early February 2026. The system stores user names, IDs, emails and lecture videos. Although the precise scope of the breach is still under investigation, compromised records involve approximately 10,000 accounts, including retired staff,” a senior foreign ministry official said Tuesday.

The official added the system was breached “multiple times” over the period and described the incident as unprecedented, adding that the government takes the issue seriously as a matter of national security.

The affected accounts include foreign service officers, attaches stationed at overseas missions and retired officials, with some overlap in the records. Resident registration numbers and phone numbers were not stored in the system and were not compromised.

The breach effectively exposed a near-complete list of foreign ministry personnel — names and titles the ministry does not openly make public with the exception of press releases about senior officials.

The online system is operated by the Korea National Diplomatic Academy, a think tank and training institution under the foreign ministry, launched in 2022 to deliver education during the COVID-19 pandemic.

The disclosure came only after a news report made the breach public — some five months after the ministry first learned of it through a National Intelligence Service tip-off in February. The ministry has since suspended the system and launched a joint investigation into the cyberattack.

Officials said the intrusion was difficult to detect through regular or periodical checks because the attacker exploited an undisclosed flaw in the software, also known as a zero-day vulnerability.

“Neither the developer nor ministry officials were aware of the vulnerability at the time. We figured out the intrusion only during the technical analysis on the vulnerability. A security update was issued after the discovery of the breach,” the official explained.

On the identity of the attackers, the ministry has not ruled out North Korea as the source of the attack.

“At this stage, there is insufficient technical analysis to determine whether North Korea is behind the attack. However, authorities are not ruling out North Korea or any possibilities, including foreign government-backed hacking groups,” the official said.

Regarding concerns over the exploitation of the leaked data, another ministry official said it is unlikely because the hacked system is isolated from the ministry's internal network and passport system, adding that access to an email address does not grant access to the email system itself.