Yonsei University, one of South Korea's top private universities, has confirmed that an outside party got into its Yonsei Portal Service without authorization and exposed personal data on about 10,000 people. The university's Office of Information and Communications confirmed the breach on October 22 through a public notice, a text message and an email to affected members. Every outlet puts the count at about 10,000. They disagree on who was affected. Yonhap, The Korea Times, SBS and ChosunBiz describe current students and graduates. Seoul Economic Daily and The Korea Herald say employee or faculty ID numbers were also exposed. A Yonsei official told The Korea Herald that the number of affected people is expected to rise. The university says it blocked the intrusion, reported the breach to the Personal Information Protection Commission (PIPC) and asked police to investigate. No threat actor has been named, and no group has claimed the attack.
Note on sourcing: all eight sources are news reports. None is the university's own notice or a regulator filing. Most of them repeat the same Yonhap story. Seoul Economic Daily and The Korea Herald add details the others lack, and in places those details conflict. UA.NEWS restates The Korea Herald's report and is not an independent source.
What Happened
According to Seoul Economic Daily, which cites the university, the intrusion happened in two short windows:
- October 20 (Tuesday): 7:41 p.m. to 7:43 p.m. KST
- October 21 (Wednesday): 4:04 a.m. to 4:11 a.m. KST
The Korea Herald gives a different timeline. It says the university first noticed the breach around 7:40 p.m. on Tuesday and shut down the affected server. It then detected a second attempted breach at 10:04 a.m. on Wednesday. The two reports agree on the first event. They differ by six hours on the second, and on whether it was a successful leak or an attempt. Neither account can be confirmed from the sources available.
Yonsei sent affected members an email notice at about 12:30 a.m. on October 22, followed by a text message. It posted details of what was exposed for each individual on its main website's notices page from 1 p.m. that day. The university says it blocked the attacker's IP address and the leak route, plans a full security review of its systems, and is strengthening monitoring. It apologized and promised steps to prevent a repeat.
What Was Taken
The reports agree that these items were exposed:
- Student ID numbers
- Mobile phone numbers
- Email addresses
- "Some system management information"
Some sources report more:
- Names: Seoul Economic Daily and The Korea Herald
- Employee or faculty ID numbers: Seoul Economic Daily and The Korea Herald
- Affiliations (department or unit): The Korea Herald
- Passwords: The Korea Herald (repeated by UA.NEWS). No other outlet mentions passwords. The reports do not say whether these were plaintext or hashed.
- System management details: Seoul Economic Daily lists these as login identification keys, failed password attempt counts, user status codes, and last login dates and times.
All sources agree that resident registration numbers and other "sensitive information" were not exposed. The Korea Herald adds that alien registration numbers and passport numbers were also not exposed, and confirmed that some international students are among the victims.
Seoul Economic Daily reports that the exposed items vary from person to person and that more could come to light as the investigation continues. Together with The Korea Herald's report that the victim count may rise, this suggests both the scope and the list of data types are still provisional.
Why It Matters
Even without national ID numbers, this dataset is useful to attackers. It links names, student or staff IDs, phone numbers, emails and departments, which is enough for convincing phishing and smishing aimed at a university community. That community includes international students, who may be less familiar with local scam patterns. If The Korea Herald's report of exposed passwords is accurate, or if the "login identification keys" can be reused, there is also a direct risk of account takeover and credential stuffing against other services.
Korean universities have been hit by this kind of incident before. Hankyung notes that in June last year the PIPC fined Jeonbuk National University 623 million won and Ewha Womans University 343 million won, 966 million won in total, for failing to take required safeguards after 2024 hacks. Jeonbuk's breach exposed about 320,000 people, including about 280,000 resident registration numbers. Ewha's exposed about 83,000 undergraduates and graduates. In both cases the PIPC found that security weaknesses dating back to when the systems were built had never been fixed, and that monitoring outside working hours, at night and on weekends, was weak. According to PIPC figures submitted to the National Assembly, cited by Hankyung, there were 38 administrative actions against education institutions over data leaks from 2023 to July this year. Twenty-three of them involved universities and colleges, covering about 1.427 million leaked records and 1.39 billion won in fines.
Hankyung points out that it is not yet known how the attacker got into Yonsei's portal or whether the university broke its data protection obligations.
The Attack Technique
Yonsei has not said how the attacker got in. It says only that the outside party viewed personal data "through abnormal means" (Seoul Economic Daily). No vulnerability, malware or attacker infrastructure has been disclosed.
Some of the reported details are still informative. If Seoul Economic Daily's timestamps are correct, the two windows lasted about two and about seven minutes, and the second fell around 4 a.m. Extracting records for about 10,000 people that quickly fits automated scraping or enumeration of an application endpoint better than slow, hands-on activity. That is our assessment, not something the university has confirmed. The exposed fields (login keys, failed-attempt counters, status codes, last-login times) look like the contents of a user or authentication table. That points to an application-layer flaw in the portal, such as an insecure direct object reference, a broken access control check or an injection bug, rather than a wider network compromise. This is also unconfirmed.
The Jeonbuk precedent is worth noting. There, the attacker used a flaw in the password-reset page to collect student IDs and then made about 900,000 brute-force attempts. Nobody has linked that technique to Yonsei, but it is a well-documented pattern against Korean university portals.
What Organizations Should Do
- Test identity endpoints for enumeration and broken access control. Password-reset, account lookup and profile APIs should not reveal whether a student or staff ID exists, and every record request should be authorized against the session that made it.
- Rate-limit portal traffic and alert on bulk reads. A single client pulling thousands of user records within minutes should raise an alert immediately, including at 4 a.m.
- Staff security monitoring around the clock. The PIPC criticized both Jeonbuk and Ewha for weak off-hours monitoring. Both Yonsei windows reportedly fell in the evening or overnight.
- Reduce and protect credential data. Store passwords only with strong, salted, adaptive hashing. Keep authentication data such as session or login keys away from data the profile API can reach, and rotate those keys after any suspected exposure.
- Reset credentials and warn users quickly. Force password and session resets for affected accounts, turn on MFA for the portal, and warn students, staff and graduates about phishing and smishing that impersonates the university.
- Fix old weaknesses in legacy academic systems. Review student information and portal platforms for flaws that have existed since they were first deployed, which was the root finding in the PIPC's earlier university penalties.
Sources: Yonsei Univ. portal hack leaks data of 10,000 students, graduates... | Yonsei University Reports Data Breach Exposing Student ID ... | Yonsei University portal hack leaks data of 10000 students ... | Yonsei portal breach affects 10,000 students and faculty, including... | 이번엔 연세대서 1만명 개인정보 유출…전북대·이화여대는 총 9.6억 과징금 한국경제 | Cyberatak na portal Uniwersytetu Yonsei dotknął 10 tys. osób UA.NEWS | Yonsei University Portal Hacked... Personal Info of ... - SBS뉴스 | Hackers breach Yonsei University portal, leak data of 10,000 in Sou...