Yonsei University Portal Hack Exposes Data of About 10,000 Students and Graduates

Yonsei University has disclosed a breach of its online portal service that exposed personal information belonging to about 10,000 current students and graduates, adding a major Seoul university to the growing list of institutions confronting data-security risks.

The university's information and communications office said Thursday that it confirmed unauthorized access by an external party. The compromised records included student identification numbers, mobile phone numbers and email addresses, along with some information used for system management.

Yonsei said resident registration numbers and other sensitive personal information were not exposed. Even so, the combination of academic identifiers and contact details may create risks for affected people, including targeted phishing or impersonation attempts. The university apologized for the concern and inconvenience caused by the incident.

The affected population spans both current students and graduates, extending the response beyond people who regularly use campus services. Yonsei has not yet provided a breakdown between those groups. Its plan to let each person review the particular types of exposed data is therefore an important part of clarifying the breach's individual impact.

After detecting the intrusion, Yonsei blocked the access point used in the attack and asked police to investigate. The university said affected individuals would be able to check the specific categories of information exposed in their cases through its website beginning at 1 p.m. Thursday.

The disclosure puts the focus on how universities protect large, long-lived databases containing information on both enrolled students and alumni. Campus portals often connect users to academic records, administrative services and communications, making them important access points whose security can affect a broad community.

The scale of the incident also means Yonsei will face scrutiny over how the unauthorized access occurred, how long it persisted and whether the initial containment measures fully closed the vulnerability. The university's statement did not identify a suspected attacker or provide a detailed timeline for the intrusion. It also did not say whether passwords or academic records were involved.

For students and graduates, the immediate next step is to review the university's individualized notice once it becomes available and remain cautious about unexpected calls, messages or emails that use university-related information. Further details are expected to emerge through the police investigation and the university's continuing response.