Source: The Korea Times

What happened

Korea’s diplomatic internet is under a volume assault — and a separate breach already showed how slow the response can be. According to The Korea Times, cyberattacks on the Ministry of Foreign Affairs, the Korea Foundation, and KOICA totaled 96,483 from January through June — nearly triple the same period last year and already above the 73,825 attempts recorded across all of last year.

The breakdown

Times cites data from Rep. Kim Joon-hwan (Democratic Party):

• By agency: Korea Foundation 70,043; foreign ministry 16,254; KOICA 10,186.
• By type across the three: attempted server data hacking 49,602; vulnerability recon 18,852; website hacking attempts 17,844; email takeover/phishing 4,535.
• By origin (where traced): untraceable >36,900; United States 19,646; Brazil 5,257.
• Context breach: hackers accessed personal data of up to 10,000 diplomats and officials on the ministry’s online education system repeatedly over nearly 10 months from April 2025. NIS tipped the ministry in February; Personal Information Protection Commission notice waited until July 19 — about three months after April awareness and past the 72-hour leak-reporting window under the Personal Information Protection Act.
• Expert caution in the same piece: an anonymous specialist noted attempts were detected and blocked — raw attempt counts are not the same as successful breaches.
• Unification ministry and affiliates saw far fewer attempts (e.g. Unification Ministry 404 in H1) but still higher year-on-year; those are described as likely aimed at defector and inter-Korean information.

Why it matters outside Korea

If you work with Korean embassies, Korea Foundation programs, KOICA projects, or any MOFA-adjacent portal from abroad, this is an account-hygiene and vendor-trust story. Origin labels that include large U.S. and Brazil buckets are not “Americans attacked Korea” — they are routing clues in incomplete attribution data. The actionable overseas lesson is the breach timeline: delayed notification after a diplomatic-education system compromise — and the gap between “attempts blocked” and “we told the privacy regulator on time.”

What travelers and expats should watch

• Anyone with MOFA / Korea Foundation / KOICA logins: rotate passwords, kill reused credentials, and treat phishing mail as the 4,535-scale threat class Times listed — not theoretical.
• Contractors and NGOs on KOICA rails: ask which systems store your staff PII and what the incident-notification SLA is; do not assume the 72-hour legal clock was met historically.
• Diplomats and alumni of ministry training portals: watch for breach notices tied to the education-system incident covering up to 10,000 people.
• Do not overread “attempts.” Times includes the expert line that blocked attempts ≠ successful hacks — still raise monitoring, do not panic-quit programs.

Context

Korelay frame: read this as pressure plus a disclosure failure, not as proof every Korean diplomatic server is owned. The Times piece earns its keep when it pairs attempt volume with the education-system breach’s months-late regulator notice. Behavior change is credential and contract hygiene — not quitting Korea partnerships on headline fear.

Korelay take

Korelay frame: read this as pressure plus a disclosure failure, not as proof every Korean diplomatic server is owned. The Times piece earns its keep when it pairs attempt volume with the education-system breach’s months-late regulator notice. Behavior change is credential and contract hygiene — not quitting Korea partnerships on headline fear.

Editor note: Desk reporting supplies the timeline; Korelay adds the overseas behavior layer (what to change, what not to assume, what to re-check). If you only need the wire facts, open the primary link in Source.

Source

The Korea Times: Nearly 100,000 cyberattacks hit foreign ministry, affiliates in 6 months — paraphrased for briefing; read the original for full detail.