Short answer
Malgeunsoft, which runs online learning systems for companies and public bodies, reported a breach to Korea's Personal Information Protection Commission. According to Yonhap, an attacker got into its education-site server on 19 September 2026. The company reports about 2.37 million records, and more than 20 client organizations are affected.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Malgeunsoft |
|---|---|
| Incident type | Supply-chain compromise |
| Status | Under investigation |
| Sector | Online learning platform vendor |
| Country | South Korea |
| Detected | 2026-09-22 |
| Disclosed | 2026-10-13 |
| People or records affected | About 2.37 million records as reported by the company, with more than 20 client organizations affected. The regulator is still verifying the scale. |
What data was exposed
- Member IDs and encrypted passwords
- Phone numbers, email addresses, home addresses, gender and dates of birth
- CI and DI identity verification values
- Guardian information and client-defined site data
- Names, affiliations or employee numbers for some client sites
What happened
Malgeunsoft, a South Korean supplier of online learning management systems, reported a data breach to the Personal Information Protection Commission (PIPC) on 22, 24 and 29 September 2026. The case became public in early October, and reports on 13 October describe about 2.37 million leaked records, according to SBS Biz.
Yonhap, via Financial News, reports an outside attacker first accessed an education-site server on 19 September at about 2:47 pm and took personal data the next morning. Malgeunsoft learned of the leak on 22 September after a client’s SMS account was used to send spam.
Who is affected
Because Malgeunsoft manages client training sites, the breach spread to the organizations that outsourced to it. More than 20 are confirmed, including the Anti-Corruption and Civil Rights Commission (about 100,000 users), the Ministry of National Defense, the Korea Educational Facilities Safety Corporation (about 40,000 users) and a Kia plant union (about 5,000 members).
What was exposed
The reported items include member IDs, encrypted passwords, phone numbers, email addresses, addresses, gender and dates of birth. CI and DI values used for identity verification, guardian information and client-defined site data were also included. Two education sites also lost names and affiliations. The PIPC stresses the 2.37 million figure comes from the company’s own report and that it is still verifying the exact scale. SBS Biz also reports the PIPC reportedly classified the case internally as a major incident.
Why third-party breaches are hard to spot
People often do not know a vendor holds their data. A course taken through an employer or union may sit on a vendor’s server for years. The first sign can be a convincing message that mentions the course. Our phishing messages guide and data breach checklist explain how to respond, and our employment scams guide covers fake HR messages.
What to watch next
Watch for the PIPC’s verified count and any enforcement decision. A lawmaker quoted by SBS Biz called for a government-wide survey of large platform companies that hold significant personal data. See more cases on our breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing that quotes the training course or employer site you used, with your name, birth date and phone number.
- Smishing that poses as your employer, ministry or union about 'mandatory training' or account re-verification.
- Credential stuffing if you reused the learning-site password elsewhere.
- Identity-based fraud attempts if CI or DI values are combined with other leaked data.
What to do if you are affected
- 01Check the notice on any training or education site you use through work, a union or a public body to see whether it is on the affected list.
- 02Change the password on that site, and on any other account that used the same one.
- 03Treat unexpected texts, calls or emails about training, certificates or accounts as suspect. Contact the organization through its official channel.
- 04Do not share one-time passwords or move money at a caller's request.
- 05Report suspicious texts to KISA on 118 and voice phishing to the police on 112.
Frequently asked questions
What is Malgeunsoft?
A Korean company that supplies online learning management systems to companies and public bodies and manages personal data for its clients' education sites under outsourcing contracts.
Which organizations are affected?
More than 20, according to Yonhap. They include the Anti-Corruption and Civil Rights Commission (about 100,000 users), the Ministry of National Defense, the Korea Educational Facilities Safety Corporation (about 40,000 users) and a Kia plant union (about 5,000 members).
How many records were leaked?
About 2.37 million, based on the company's own report. The Personal Information Protection Commission says it is still verifying the actual scale.
When did the attack happen?
Yonhap reports the attacker first accessed the education-site server on 19 September 2026 and took data the next day. Malgeunsoft learned of the leak on 22 September after a client's SMS account was used to send spam.
Sources
- Malgeunsoft: 2.37 million records reported, PIPC classes it a major incident (Korean-language article, headline in English), SBS Biz, 2026-10-13
- Malgeunsoft education platform breach affects 20+ organizations (Korean-language article, headline in English), Yonhap News (via Financial News), 2026-10-13
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.