Nearly 100,000 cyberattacks hit foreign ministry, affiliates in 6 months

The Korea National Diplomatic Academy campus in southern Seoul, July 21 / Yonhap

Cyberattacks targeting the Ministry of Foreign Affairs and its affiliated agencies nearly tripled in the first half of this year compared to the same period last year, data showed, raising fresh concerns about the security of sensitive diplomatic information following a recently disclosed data breach at the ministry.

According to data provided by Rep. Kim Joon-hwan of the ruling Democratic Party of Korea, cyberattacks targeting the foreign ministry, the Korea Foundation and the Korea International Cooperation Agency (KOICA) totaled 96,483 between January and June, far outpacing the 73,785 attempts recorded across the entire previous year.

By organization, the Korea Foundation bore the brunt of the attacks with 70,043 cases, followed by the foreign ministry with 16,254 and KOICA with 10,186. By attack type across all three agencies, attempted server data hacking topped the list at 49,602 cases, followed by server vulnerability information gathering attempts with 18,852, website hacking attempts with 17,844, and email account takeover and phishing with 4,535.

By origin, attacks from untraceable sources accounted for the largest share at over 36,900 cases, followed by those traced to the United States at 19,646 and Brazil at 5,257.

The surge in hacking attempts came amid a historic data breach at the foreign ministry’s online education system, where hackers accessed the personal information of up to 10,000 diplomats and government officials multiple times over nearly 10 months since April 2025. The ministry faced criticism not only for being unaware of the potential hack until February, when the National Intelligence Service discovered suspicious activity on the website and tipped off the ministry, but also for its delayed response to the matter.

The ministry delayed notifying the Personal Information Protection Commission of the breach until July 19 — roughly three months after first learning of the attack in April — and well beyond the 72-hour reporting window to report data leaks under the Personal Information Protection Act.

Experts said the spike in attempts reflects a broader global shift in targeting patterns.

“Cyberattacks have escalated since last year, reflecting a growing trend where attackers are no longer targeting just the private sector, but actively expanding their reach into the public sector,” said Hong Jun-ho, professor at Sungshin Women's University. “Given our geopolitical reality as a divided nation, Korea becomes a subject of a lot of cyberattacks.”

Hong called for a pangovernment cybersecurity audit to bring public sector standards up to those of the private sector.

"Private companies publicly disclose their security information, but in the public sector, general IT departments often end up taking on security duties on the side," he said. "Public institutions must mandate dedicated security personnel to build a proper governance system and reinforce access controls." He added that any review should extend beyond central government agencies to encompass all affiliated public bodies and institutions.

However, another expert, who spoke on condition of anonymity, offered a note of caution on the raw numbers.

“Hacking attempts are increasing across the globe, though the exact cause remains unclear. However, all of these attempts were detected and blocked, meaning the agencies were not hacked. The number of attempts alone does not indicate a security breach,” the expert said.

By comparison, hacking attempts against the Ministry of Unification and its affiliates were significantly lower than the Ministry of Foreign Affairs.

The unification ministry recorded 404 attempts in the first half of the year, while the South-North Korea Exchange and Cooperation Support Association recorded 2,232 and the Korea Hana Foundation recorded 944 in the same period, all higher than in previous years. The attacks are believed to be aimed at obtaining information on North Korean defectors and inter-Korean affairs.