Key points
- ,132 pieces of personal information were leaked, with 1,130 records traced to one 2021 attack.
- Departmental systems were the most frequent target, accounting for 19 of the 28 confirmed incidents.
- Attack frequency dropped to one incident in 2024 before rising to five in 2025 and four in 2026.
Seoul National University submitted data to Democratic Party Representative Baek Seung-ah on Sunday, detailing 28 hacking incidents since 2021. According to The Cyber Express, these breaches resulted in the exposure of 1,132 pieces of personal information belonging to students, faculty, and staff. The university’s submission provides a year-by-year breakdown of the security failures, highlighting a significant concentration of risk in specific infrastructure components rather than a uniform threat across all digital assets.
In plain English
The data shows that departmental systems were the primary target, suffering 19 of the 28 attacks. Laboratory systems followed with six incidents, while research systems were hit twice. One attack affected an institutionwide system. This distribution indicates that attackers focused on fragmented, department-level infrastructure rather than central administrative hubs. The concentration of breaches in these specific areas reflects the targets chosen by adversaries, with departmental systems bearing the brunt of the activity across the six-year period.
The background
The annual attack count peaked at 10 incidents in 2022, following eight attacks in 2021. Activity then fell sharply, with zero recorded incidents in 2023 and only one in 2024. However, the trend reversed in 2025 with five confirmed attacks, and four more have been verified so far in 2026. Despite the fluctuating frequency of breaches, the volume of leaked data remains heavily skewed toward the past. Nearly all exposed records, 1,130 out of 1,132, originated from a single cyberattack in 2021.
What changes now
That 2021 breach involved hackers planting malicious software on SNU servers, which let them run commands remotely. The source material does not specify how long the malware persisted or whether it was detected immediately. The subsequent years show fewer incidents but no mention of remediation efforts for the initial breach. The recent rise in attacks in 2025 and 2026 suggests that the university continues to face persistent threats, with new incidents occurring despite the historical concentration of data loss in the earlier period.
What to do and how to stay safe: Seoul National University
- Audit departmental and laboratory systems for unauthorized remote access tools or persistent malware.
- Review logs for command execution patterns that do not match standard administrative activity.
- Verify that personal information stored in decentralized systems is encrypted and access-controlled.
- Monitor for new intrusion attempts, especially given the rising trend in 2025 and 2026.
Step-by-step guide: DDoS Protection: 8 FAQs on Mitigation and Architecture
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many hacking incidents has Seoul National University experienced since 2021?
The university recorded 28 hacking incidents between 2021 and the current year, with the highest annual total occurring in 2022.
What caused the majority of the data leaks at Seoul National University?
Almost all leaked data, 1,130 records, stems from a single 2021 attack where hackers installed malicious software to run remote commands.
Which systems were targeted most frequently in these attacks?
Departmental systems were the most common target, accounting for 19 of the 28 incidents, followed by laboratory systems with six hits.
