President's passport data likely caused by internal upload to Google

Korea is investigating whether an internal mistake or automated security scan leaked personal data of President Lee Jae Myung and 167 others.

The personal information of 168 people, including President Lee Jae Myung and first lady Kim Hea Kyung, was likely exposed through internal mishandling rather than a hack when it was uploaded to a malware-scanning website that shares files with security firms worldwide.

The information was posted June 2 on VirusTotal, a paid malware-scanning platform run by Google, according to JoongAng Ilbo reporting on Tuesday.

Those affected in the leak include the presidential couple, senior government officials, the Blue House and Foreign Ministry staff, Presidential Security Service agents and Blue House reporters, per the presidential office and security industry sources on Monday. Their names in Korean and English, affiliations, job titles, birth dates, passport numbers and passport issue and expiration dates were among the exposed information.

Lee orders officials to review establishing cybersecurity task force

Lee orders officials to review establishing cybersecurity task force

Presidential data breach may have been internal leak, Foreign Ministry says

Presidential data breach may have been internal leak, Foreign Ministry says

President, first lady among 168 delegation members hit by data leak

President, first lady among 168 delegation members hit by data leak

The file's title included “Korea-Belgium,” which suggests it could have been prepared for Lee's trip to Europe, which began with a stop in Brussels on June 9.

VirusTotal checks files or URLs that users upload for malware and other infections. Subscriptions cost $75,000 to $1.1 million a year. Because it can check for infections without separate security software, the platform is reportedly widely used by security staff at companies and institutions.

The problem is that data scanned on the platform is shared in real time with antivirus companies and paying members around the world. VirusTotal runs on a “collective intelligence” model, openly sharing all information so that security threats can be tackled jointly. Security experts worldwide use the shared data to study new malware variants, and security firms use it to develop antivirus programs, much as developers their code on GitHub.

Given how the platform works, experts speculate that a staff member with access to the Blue House's internal personal data ran a malware scan without properly understanding how VirusTotal operates.

“It is unlikely that a hacker who maliciously stole internal information uploaded it to a global sharing platform,” said Hwang Seok-jin, a professor at Dongguk University’s Graduate School of International Information Security. “It may have occurred due to an insider’s lack of security awareness or a work-related mistake rather than hacking.”

Personal information of 3,000 National Election Commission (NEC) employees was also leaked through the platform in 2024. “An employee of an outside company that maintains our security system uploaded internal security inspection results to the platform to strengthen protection against malware,” an NEC official said at the time.

Experts also say the Blue House's internal security system may have uploaded the files automatically without security staff knowing, as security software may have flagged incoming emails or attachments as suspicious and sent them for scanning.

“In the past, there were frequent similar cases where email security programs mistook normal files as suspicious and automatically ran malware scans, leading to data leaks,” said Youm Heung-youl, a professor emeritus of information security engineering at Soonchunhyang University. “If it was an insider’s mistake, there must be security awareness training, and if it was a product issue, the security solution must be improved immediately.”

Critics also point to broader flaws in the Blue House’s security system, noting that the office was unaware of the leak for five months even though the personal information of senior officials had been exposed en masse.

“It is not common sense for classified information to be uploaded to a sharing platform, and it is also hard to understand that the document was unencrypted plain text,” said Chang Hang-bae, a professor of industrial security at Chung-Ang University. “Not even being aware of the leak for five months means there is a problem with the very control over security management.”

The Blue House held an emergency meeting chaired by the presidential chief of staff on Tuesday to determine how the leak happened and to review its security system. The Korean National Police Agency’s cyberterror investigation unit has opened a preliminary investigation, and the Foreign Affairs Ministry, which manages the presidential aircraft, said it would look into the case and take necessary measures.

“Discussions on setting up a pan-government response body covering both the public and private sectors are also needed,” Lee said at a Cabinet meeting at the Blue House on Tuesday. “Please actively consider forming a powerful and effective ‘cybersecurity czar’ body that can oversee and coordinate scattered security functions.” A czar is an official put in charge of overseeing and coordinating a specific policy area.

BY OH SAM-GWON [[email protected]]

This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.