The Thinkng Bull cyberattack targeted the Seoul-based math academy headquartered in Daechi-dong. The attack has exposed the personal information of students and parents, drawing scrutiny from South Korea’s data protection authorities.
The National Math Academy, which runs roughly 80 branches across the country, disclosed the breach to parents on September 17, confirming that an unidentified hacker had infiltrated its exam reservation website.
Details of the Thinkng Bull Cyberattack
According to the academy, the intruder informed staff that they were “securing all data,” language that led Thinkng Bull to conclude there was a high likelihood that the personal details of every parent and student who had booked exams through the site had been compromised.
The exam reservation platform held sensitive registration data, including students’ names, schools, grade levels and dates of birth, along with parents’ phone numbers. In response, the National Math Academy took the reservation site offline and filed a report on the breach with the relevant government authorities.
The academy also said it was compiling documentation to request a formal police investigation into the intrusion.
Academy’s Response and Warnings to Parents
Following the cyberattack on Thinkng Bull, the academy issued a direct warning to parents about the risk of follow-on scams. It noted that the stolen data could be used for “improper purposes” and cautioned that phone calls or text messages from unfamiliar numbers should be treated as potential voice phishing attempts, urging families to “respond calmly” rather than share further details. Parents were also asked not to hand over any personal information or click on unfamiliar links.
Thinkng Bull apologized for the incident, stating it “deeply” regretted the concern caused and expressed hope that no parents or students would suffer actual harm as a result. The academy said the exam reservation website would remain suspended until it completed measures designed to prevent a similar breach from happening again.
Regulatory Oversight
South Korea’s Personal Information Protection Commission confirmed that Thinkng Bull reported the leak at approximately 9:00 p.m. on September 17. As of the latest updates, the exact number of affected individuals had not yet been determined.
A commission official said the agency was still verifying the facts of the case, including whether any legal violations occurred, and that the timing of any further investigation would depend on the outcome of that review.
Background on Thinkng Bull
Thinkng Bull is known as an advanced math program aimed at elementary school students, with a curriculum that allows children in the 4th through 6th grades to complete three years of middle school math material in 13 months.
The academy was founded in 2005 as a single location in Daechi-dong and has since expanded to more than 80 branches nationwide, including one in Gangnam District’s Daechi neighborhood.
What Comes Next?
The cyberattack on Thinkng Bull adds to a string of data breaches affecting private education providers in South Korea, raising fresh questions about how academies safeguard the personal records of minors collected through online registration systems.
With the Personal Information Protection Commission still reviewing the incident, further details — including the scope of the breach and any regulatory penalties — are expected to emerge as the investigation proceeds.
In the meantime, the National Math Academy has advised affected families to remain alert to unsolicited contact and to avoid sharing additional personal data until the situation is resolved.
