Key points
- Seoul National University reported 28 hacking incidents between 2021 and 2026.
- A 2021 cyberattack involving remote command execution leaked 1,130 records.
- Departmental systems were the primary target, suffering 19 of the 28 incidents.
Seoul National University has disclosed a significant history of cyber intrusions, reporting 28 distinct hacking incidents since 2021. According to data submitted to Rep. Baek Seung-ah of the Democratic Party, these attacks resulted in the exposure of more than 1,100 pieces of personal information belonging to students, faculty, and staff. The university’s disclosure highlights a persistent threat landscape, with activity fluctuating year over year but never fully ceasing during the six-year period covered by the report.
By the numbers
- 28 total hacking incidents reported by Seoul National University from 2021 through early 2026.
- 1,132 pieces of personal information leaked in total across all reported incidents.
- 19 of the 28 incidents targeted departmental systems, the most frequently hit category.
What the figures mean
The volume of attacks peaked in 2022 with 10 incidents, following eight attacks in 2021. Activity then dropped sharply, with no incidents recorded in 2023 and only one in 2024. However, the trend reversed in 2025 with five confirmed incidents, and four more have been identified so far in 2026. This fluctuation shows the varying frequency of attacks against the university over the six-year period.
The vast majority of data loss stems from a single event. Out of 1,132 leaked records, 1,130 trace back to the 2021 cyberattack. In that breach, attackers planted malicious software on university servers, enabling them to run commands remotely. This incident accounts for nearly all the personal information exposed during the period. The source material does not specify the origin of the remaining two leaked records.
Departmental systems were the most frequent target, accounting for 19 of the 28 incidents. Laboratory systems were compromised six times, research systems twice, and one institutionwide system was affected. This distribution indicates that departmental systems faced the highest number of attacks compared to other system types within the university.
What to watch
Security teams should monitor for unauthorized remote command execution on servers, as seen in the 2021 incident. The 2021 incident demonstrates that malware can allow attackers to run commands remotely. Organizations with decentralized IT structures, such as universities, should pay particular attention to securing departmental and laboratory systems, which were targeted frequently. Additionally, the increase in incidents in 2025 and 2026 indicates a rise in attack frequency against the university.
What to do and how to stay safe: Seoul National University
- Review server logs for unauthorized remote command execution, particularly on systems hosting sensitive research or departmental data.
- Implement strict network segmentation to isolate departmental and laboratory systems from central administrative networks.
- Conduct regular audits of installed software on servers to detect and remove persistent malware or unauthorized tools.
- Monitor for unusual data access patterns that may indicate ongoing exfiltration.
Step-by-step guide: Account Takeover Risks and Low-Cost Defenses for Small Teams
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many hacking incidents has Seoul National University reported since 2021?
Seoul National University has reported 28 hacking incidents between 2021 and 2026.
What caused the majority of the data leaks at Seoul National University?
Nearly all leaked data, 1,130 of 1,132 records, resulted from a 2021 cyberattack where hackers planted malware on servers.
Which systems were most frequently targeted in the Seoul National University breaches?
Departmental systems were the most frequent target, hit in 19 of the 28 incidents.
