The passwords on about 75,000 Google Workspace for Education accounts used by roughly 200 schools and education institutions in Daejeon, South Korea, were changed without authorization, Seoul Economic Daily reported Wednesday. Google told local education officials it had blocked the accounts while responding to an external attack, and the country's education minister has pledged a nationwide survey for similar cases.

What Happened

The accounts sit on the domain run by the Daejeon Metropolitan Office of Education. Users began running into login failures in a series of incidents between Sept. 28 and Oct. 1. The office confirmed on Oct. 4, after being contacted by Google, that the passwords had been changed without permission.

According to the report, Google said the accounts were blocked in the course of its response to an external attack. Neither Google nor the education office has said how the attackers gained access or what they did with the accounts. The office suspended the affected accounts while it works with Google to restore them and told users to reset their passwords where needed.

RelatedDealership IT Vendor Reports Attack Surge, Says MFA Was in Place When Logins Were Stolen

No suspected leak of personal information had been reported as of Wednesday. Officials nonetheless warned students and staff to be alert for secondary harm, including identity theft, smishing text messages and phishing that could exploit the incident.

Why It Matters

School Google accounts are rarely just email. They are typically used to sign in to classroom tools, shared documents and other services, so an attacker who controls one may reach material well beyond the inbox. A mass, unauthorized password change across an entire education domain also locks out tens of thousands of users at once, disrupting schoolwork until accounts are restored.

The incident also exposed how dependent officials are on the platform operator for answers. Lawmaker Kang Kyung-sook pointed to reliance on foreign platforms, noting that the ministry cannot independently verify the scope of the damage without confirmation from the overseas operator. The full extent of the breach will not be clear until Google provides a more detailed account, the report said.

Government Response

Education Minister Choi Kyo-jin told a National Assembly hearing Wednesday that the ministry would conduct a full survey, to the greatest extent possible, of whether other education offices and schools were hit in similar ways, and report back to lawmakers.

What to Watch

The key open questions are how the attackers got in, whether through reused passwords, phishing or a weakness in how the domain was administered, and whether any student or staff data was accessed before Google stepped in. Also watch the results of the ministry's nationwide check, how quickly the Daejeon accounts are restored, and whether education offices tighten sign-in requirements such as multifactor authentication on school accounts.