CAC: unauthorized access to the Academic Support Navi donation service

An unauthorized program was installed and run on a web server for CAC's Academic Support Navi donation-application service from late December 18 to the evening of December 25, 2025, when CAC detected it and stopped and isolated the service. The first notice was issued on January 5, 2026. Its February investigation inferred resource abuse such as cryptocurrency mining as the main purpose and found no concrete traces of personal or confidential information being read or exfiltrated. Because information was technically accessible, CAC nevertheless made statutory possible-leak reports and notifications. After rebuilding the environment and an external vulnerability assessment, CAC resumed the service on March 23; individual customer application sites may reopen on different dates.