2026 Korea National Diplomatic Academy — ~10-month intrusion; MFA staff + overseas diplomats’ data presumed leaked (~10K entries)

Verified Ministry of Foreign Affairs disclosure — initial platform compromise notice July 20, 2026; expanded briefing July 21, 2026. South Korea’s Korea National Diplomatic Academy online training platform was compromised for nearly ten months after an attacker exploited a zero-day in server software and weak security settings (control between April–May 2025, continued through early February 2026 via legitimate privileges). Systems were shut down after abnormal-access alerts in early February 2026. On July 21, Korea JoongAng Daily reported the Foreign Ministry called the incident an “unprecedented” cyberattack and said personal information of nearly all South Korean diplomatic personnel is presumed compromised, exposing up to about 10,000 administrative and intelligence records (names, user IDs, emails, encrypted passwords, job titles, department affiliations). Officials clarified the 10,000 figure is data entries rather than a de-duplicated headcount and may include former staff. Overseas posts can include military attachés and intelligence officers from other agencies, raising national-security sensitivity. BreachHistory indexes 10,000 per the ministry-linked entry count cited in JoongAng Daily.