SecurityNot yet confirmed elsewhere1 publisher2 min readPublished
One 2021 malware breach accounts for 1,130 of Seoul National University's 1,132 leaked records
Seoul National University told a lawmaker that 1,130 of the 1,132 records leaked in 28 hacking incidents since 2021 came from a single 2021 attack. Departmental systems were hit most often, so attack frequency and data loss need separate explanations.
The Watch · Security desk
Four figures. 1,130 leaked personal records trace back to a single 2021 cyberattack. SNU recorded 28 hacking incidents since 2021, and 19 of them hit departmental systems. SNU has detected 588 hacking attempts so far this year, already more than its totals for 2024 and 2025.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Records from one 2021 attack | 1,130 records | 5 | |
| Hacking incidents since 2021 | 28 incidents | 1 | |
| Incidents on departmental systems | 19 incidents | 4 | |
| Attempts detected so far this year | 588 attempts | Already above 2024 and 2025 totals | 9 |
What happened
- Incidents ran eight in 2021, ten in 2022, none in 2023, one in 2024, five in 2025 and four so far this year, with 2022 the highest annual total.
- Laboratory systems were the next most common target with six incidents, followed by research systems with two and one institutionwide system.
- The other two leaked records came in 2024, when attackers targeted a research institute for files holding researchers' biographies and resumes.
Why it matters
- exposure Departmental and lab systems took 25 of 28 incidents, so by SNU's own count they are the most repeatedly attacked part of the university.
- constraint A weak-governance finding on departmental systems would need the 1,130-record breach tied to one. Incident counts alone cannot supply that link.
- decision SNU has requested no police investigation into any of the 28 incidents, so the public account of the 1,130-record breach rests on the university's own disclosure.
According to The Cyber Express, departmental systems were hit in 19 of the 28 incidents, about 68 percent [4][12]. Add the six laboratory systems and the share is 25 of 28, or 89 percent [4][13]. Those are the systems attackers reach most often.
Records are far more concentrated than incidents. Of the 1,132 leaked, 1,130 trace to one 2021 attack, or 99.8 percent [5][14]. The attackers planted malicious software on SNU servers, ran commands remotely and took personal details, including portal IDs [6]. The reported figures do not say which category those servers fell into or how any category is administered.
In our view the numbers support a narrower claim than weak governance of departmental systems. Attackers hit those systems most often, and one server compromise produced nearly all the lost data. Apart from the 2021 and 2024 attacks, no incident had a confirmed leak [8]. That leaves 26 of 28, or 93 percent, with none [15].
The trend depends on the baseline. The Cyber Express writes that successful breaches have fallen since the 2022 peak [18], and against ten incidents in 2022 that holds. Against the single incident in 2024 it does not: SNU has since recorded nine, five in 2025 and four so far this year [3][16]. Attempts moved the same direction. This year's 588 already exceed the 2025 total of 575 by 13 [9][17].
SNU said, "These figures represent hacking attempts detected and blocked through our security monitoring." [19] It added, "We prevented the incidents from spreading through real-time responses and immediately completed the necessary security measures." [20]
SNU submitted the data on Sunday to Rep. Baek Seung-ah of the Democratic Party [2]. It said it notified the Ministry of Education or the Personal Information Protection Commission whenever a leak was confirmed [10]. It has never requested a law enforcement investigation into any of the attacks [11].
What to watch
- Whether SNU or the Ministry of Education says which system category the compromised 2021 servers belonged to.
- Whether the four incidents confirmed so far this year end the year below 2025's five, and whether attempts keep rising past 588.
- Whether SNU requests a law enforcement investigation into any incident; it has requested none so far.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+15
- Incentives
- Insufficient
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Seoul National University has been struck by 28 hacking incidents since 2021.
- [2]
The figures come from data SNU submitted on Sunday to Rep. Baek Seung-ah of the Democratic Party.
- [3]
SNU recorded eight incidents in 2021, ten in 2022 (the highest annual total), none in 2023, one in 2024, five in 2025 and four so far this year.
- [4]
Departmental systems were hit in 19 of the 28 incidents, laboratory systems in six, research systems in two, and one attack affected an institutionwide system.
- [5]
A total of 1,132 pieces of personal information were leaked over the period, and 1,130 of them trace back to a single cyberattack in 2021.
- [6]
In the 2021 breach, hackers planted malicious software on SNU servers, which let them run commands remotely and steal personal details of university members, including portal IDs.
- [7]
The remaining two pieces of personal information were exposed in 2024, when attackers went after a university research institute, focusing on files containing researchers' biographies and resumes.
- [8]
According to the data, no personal information leaks were confirmed in any of the other hacking incidents.
- [9]
SNU logged 561 hacking attempts in 2024 and 575 in 2025, and has detected 588 so far this year, already exceeding the totals of both previous years.
- [10]
SNU said it notified either the Ministry of Education or the Personal Information Protection Commission whenever a personal information leak was confirmed.
ReportedSupportedSource: Seoul National University, as reported by The Cyber ExpressView cited source - [11]
SNU has never requested an investigation by law enforcement authorities into any of the attacks.
ReportedSupportedSource: Seoul National University, as reported by The Cyber ExpressView cited source - [12]
Departmental systems account for about 68 percent of the 28 incidents.
- [13]
Departmental and laboratory systems together account for 25 of the 28 incidents, about 89 percent.
- [14]
The single 2021 attack accounts for about 99.8 percent of the leaked records.
- [15]
Twenty-six of the 28 incidents, about 93 percent, had no confirmed personal information leak.
- [16]
SNU recorded nine incidents in 2025 and so far this year, against one in 2024.
- [17]
This year's 588 detected attempts already exceed the 2025 total of 575 by 13.
- [18]
The Cyber Express writes that the number of successful breaches has fallen since the 2022 peak while the yearly count of attempted attacks has continued to climb.
ReportedContestedSource: The Cyber Express2 sources— create a free account to open themView cited source - [19]
SNU said: "These figures represent hacking attempts detected and blocked through our security monitoring."
ReportedInsufficientSource: Seoul National University, as quoted by The Cyber ExpressView cited source - [20]
SNU added: "We prevented the incidents from spreading through real-time responses and immediately completed the necessary security measures."
ReportedInsufficientSource: Seoul National University, as quoted by The Cyber ExpressView cited source
Sources
1 independent publisher whose own reporting we read for this story.
- thecyberexpress.comSeoul National University Faces 588 Hacking Attempts in 2026
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
Entities
- Seoul National University College of EngineeringFollow
- Baek Seung-ahFollow
- Personal Information Protection CommissionFollow
- South Korean Ministry of EducationFollow
- The Cyber ExpressFollow