Korean diplomatic academy's training platform was hacked for nearly 10 months — and no one knew

The online training system used to educate diplomats and senior government officials at the Korea National Diplomatic Academy was compromised for nearly 10 months, from April last year through February.

“We view the growing sophistication and expanding scope of cyberattacks as a matter of serious concern,” the Ministry of Foreign Affairs said as it disclosed the breach on Monday.

The Foreign Ministry shut down the system after being notified of the breach by related authorities in early February. Five months later, however, the system has yet to be restored as an investigation continues.

The unidentified attacker took control of the server between April and May last year by exploiting a “zero-day” vulnerability — a previously undisclosed security flaw in the server software — as well as weaknesses in the system’s security settings, according to the ministry.

The attacker then reportedly continued accessing the server through February using legitimate software privileges.

The academy’s online training system is a digital education platform through which foreign service officers take job-related and language courses.

“Because the attacker exploited a zero-day vulnerability that even the software manufacturer was unaware of and then later used legitimate access privileges after the [initial] login, the breach was difficult to detect through conventional methods,” the ministry said. “No security update was available at the time, which limited our ability to respond.”

The compromised server reportedly stored not only training videos but also personal information, including names and usernames of its users.

The Korea National Diplomatic Academy is a key institution under the Foreign Ministry and is responsible for training diplomatic personnel and conducting foreign policy research.

About 40 diplomatic service candidates complete a yearlong regular program in the academy each year. Serving diplomats also undergo mandatory training before overseas assignments, promotions or appointments as heads of diplomatic missions.

Senior officials from central government’s ministries or local governments, as well as executives from public institutions, also attend the academy.

Concerns have emerged that the personal data of large number of diplomats and senior government officials may have been leaked since the institution holds information on key personnel in Korea’s foreign affairs and national security apparatus,

A system at the heart of Korea’s diplomatic and national security training apparatus remained in hackers’ hands for nearly 10 months. Authorities detected the breach only after being alerted by an outside agency, raising serious questions over glaring failures in cybersecurity oversight.

“At this point, it is difficult to determine exactly what information was leaked,” the ministry said. “We will continue strengthening our internal security systems and management measures in close cooperation with the relevant authorities.”

BY YOON JI-WON [[email protected]]