A Yonsei University cyberattack has compromised the personal information of roughly 10,000 students and graduates after outsiders gained unauthorized access to the school’s online portal. The breach comes months after Sogang University disclosed a far larger leak.
The university’s Office of Information and Communications confirmed the breach in a notice sent to affected individuals on Thursday. “The personal information of some university members was confirmed to have been leaked following unauthorized external access to the Yonsei Portal Service,” the office stated.
What the Yonsei University Cyberattack Exposed
The compromised data included student identification numbers, mobile phone numbers, and email addresses, along with system management details such as login identification keys and the number of failed password attempts on affected accounts. Resident registration numbers were not exposed.
From 1 p.m. Thursday, affected individuals could check on Yonsei University’s official website which details were compromised.
Two Hacking Attempts in Less Than a Day
The cyberattack on Yonsei University reportedly began at around 7:41 p.m. on Tuesday.
“An attack on the university’s system was detected at the time, and we immediately blocked the IP [internet provider] address,” a university representative told the JoongAng Ilbo. “While we were analyzing the cause at around 10 a.m. the following day, a second hacking attempt was made from a different IP address, which we also blocked.”
Yonsei reported the incident to the Personal Information Protection Commission (PIPC) on Wednesday afternoon. The Personal Information Protection Act requires organizations to report a personal data breach within 72 hours of becoming aware of it and to notify affected individuals.
“We plan to gather additional evidence related to the hacking attacks and refer the case to investigative authorities,” the representative said.
The university also plans a comprehensive security review of its systems, along with stronger monitoring and security measures. It urged students and graduates to be wary of text messages, phone calls, and emails claiming to be from the university, and to avoid clicking links from unknown sources or entering personal information on suspicious websites.
Sogang University and a Wider Pattern of Breaches
The cyberattack on Yonsei University follows a series of attacks on higher education institutions. On Aug. 14, Sogang University suffered an external cyberattack that exposed approximately 180,000 records containing personal information of students, graduates, and university staff, according to a notice posted on the Sogang University website.
The problem goes beyond recent cases. According to data the Ministry of Education submitted to People Power Party Rep. Kim Meen-geon, personal data breaches at universities affected 2.8 million people between 2022 and July this year.
Calls for Support After Yonsei and Sogang University Incidents
Experts have called for more cybersecurity personnel and greater funding as hacking attacks grow increasingly sophisticated, including through the use of AI.
“Just as the government develops information security measures for small- and medium-sized businesses, it should establish support measures to strengthen cybersecurity at universities,” said Kim Seung-joo, a professor at Korea University’s School of Cybersecurity. “Support appears particularly necessary for private universities that lack sufficient funding for cybersecurity.”
