Yonsei University said Thursday that hackers breached its student portal and exposed personal information for about 10,000 current students and graduates, one of the largest campus data incidents in South Korea this year. The Seoul school’s information and communications office confirmed unauthorized external access and apologized for the disruption.
Compromised records include student identification numbers, mobile phone numbers and email addresses, along with limited system-management metadata, according to the university. Officials stressed that resident registration numbers and other highly sensitive identifiers were not accessed. After detecting the intrusion, IT staff blocked the entry point and asked national police to open a formal inquiry, the university said.
What students are being told
Yonsei said it will publish a detailed breakdown of which data categories were exposed for each affected person on its website from 1 p.m. Thursday, giving students and alumni a way to check their status without visiting campus offices. Counseling lines and FAQ pages are being updated as forensic work continues.
The breach lands during a sensitive stretch for Korean higher education, where competitive admissions and alumni networks depend on trusted digital services. Portal systems handle course registration, transcripts and internal messaging, making them high-value targets for criminals who resell contact data or use it for phishing.
Regulatory and sector pressure
Universities in South Korea fall under the Personal Information Protection Act, which requires prompt notification when leaks reach a scale that could harm individuals. The Korea Internet and Security Agency often advises institutions after major incidents, though Yonsei has not yet said whether national regulators have opened a formal review.
Campus IT teams nationwide have been on alert since a string of ransomware and credential-stuffing attacks hit schools and hospitals over the past year. Security researchers say many portals still rely on legacy login flows that make password reuse attacks easier, especially when students access services from personal devices off campus.
The Ministry of Education has pressed universities to segment student data and log access more aggressively, but implementation varies by school budget. Yonsei ranks among Korea’s most internationally visible campuses, meaning any leak also carries reputational risk with overseas partners and exchange programs that share roster data through the same portal stack.
For Yonsei’s 10,000 affected users, the immediate risk is targeted deceptive phone calls and phishing emails that reference real student ID formats. The university urged everyone on the list to enable two-factor authentication where available, watch financial accounts closely and report suspicious messages that cite Yonsei branding. Alumni associations said they are coordinating with the school to warn members abroad who may still have active portal credentials.