Exposing the President's Personal Information to the World...

The personal information of President Lee Jae-myung, the First Lady, key Cheong Wa Dae aides, and major cabinet ministers has been leaked to the world. A file containing sensitive personal information classified at the state secret level—including dates of birth, passport numbers, issue dates, and expiration dates of 168 individuals—remained openly accessible for five months on VirusTotal, a paid malware inspection service.

At the time, President Lee visited Belgium, Italy, and France for 10 days starting June 9 to attend events including the CG summit. Accompanying the presidential couple were high-ranking officials such as Prime Minister Han Seong-sook (then Minister of SMEs and Startups) and National Security Adviser Wi Sung-lac, alongside presidential security personnel and journalists from multiple media outlets. All of their personal information was leaked in its entirety.

Cheong Wa Dae announced that it has requested a police investigation. It also explained that "the Ministry of Foreign Affairs and other agencies will take further measures going forward." The Ministry of Foreign Affairs stated that it would swiftly reissue passports for the affected individuals. The police have also quickly launched an internal investigation into the circumstances of the leak and those responsible. However, the fallout from this leak is far from simple.

① The President's Close Protection Network Put at Risk

This is because the identities of core presidential security personnel, such as bodyguards and food inspectors, can now be pinpointed. Normally, the names and faces of Presidential Security Service agents and food inspectors who test for poisons are strictly classified. If their English names, dates of birth, and passport numbers are exposed, hostile nations or terrorist groups could conduct counter-surveillance to identify security personnel at local airports and event venues. Furthermore, combining their passport numbers and names could allow adversaries to look up reservations in global airline booking networks or immigration databases, track movement routes, and even attempt to alter seat assignments. This could create severe vulnerabilities in on-site security protocols.

② Gaining a Foothold for Targeted Operations and Precision Spear Phishing by Hostile Intelligence Agencies

The passport numbers, expiration dates, and official titles of high-ranking and core public officials provide ideal material for highly tailored targeted attacks impersonating the Ministry of Foreign Affairs, overseas diplomatic missions, foreign hotels, or airlines. Sending tailored malicious emails such as "Guidance on Passport Reissuance" or "Request for Local Protocol Visa Verification" could easily lead targeted officials to open them without suspicion. If malicious code is planted this way, the entire internal government network faces the risk of being breached. The unique personally identifiable information of core aides who formulate foreign and security policy can also be registered in foreign intelligence databases to serve as targets for covert operations—such as long-term tracking and gathering leverage when combined with financial or immigration records.

③ Plummeting Diplomatic Trust, Chilling International Security Cooperation

The trip involved multilateral diplomatic schedules, including the G7 summit and an EU summit. Host governments receive lists of security personnel for top officials to carry out joint security operations. From the host nations' perspective, therefore, this incident cannot help but be seen as a severe failure in security standards by the South Korean government, fostering distrust when it comes to sharing sensitive military and diplomatic intelligence in the future.

④ Limits of Post-Incident Damage Control

Even if diplomatic or official passports are urgently reissued, a permanent personal database consisting of "names, dates of birth, and specific official titles" remains indefinitely in the hands of potential attackers. The original files that have already spread across the globe cannot be retrieved. As a result, the 168 affected individuals will face ongoing secondary security threats during all future overseas business trips and official duties.

It has not yet been clearly established when and through which path this leak occurred. However, looking at the circumstances, a reasonable and highly plausible deduction can be made.

① How Did It End Up on VirusTotal?

VirusTotal is a service that inspects files for malware using dozens of global antivirus engines. Unlike typical antivirus programs that only run scans "locally on your computer," it transmits the entire original file to global servers for analysis. Ahead of the president's European tour, a working-level government official likely received the passenger list file compiled from outside sources or various agencies. At that point, the official most likely sought to verify whether the email attachment was infected with malware. Instead of scanning it with internal antivirus software or consulting the security department, it is presumed that the official opened a web browser and "dragged and dropped" the file onto VirusTotal, uploading the entire file to the website's server for inspection.

② Why Was It Exposed So That Anyone Could Download It?

VirusTotal's core business model is sample sharing. VirusTotal treats all uploaded files as assets and grants full sample download privileges to paid subscribers worldwide, including security researchers, corporations, and intelligence agencies. Consequently, files uploaded by users for malware inspection are automatically added as "new samples" to the databases of numerous security professionals and paid subscribers globally. Therefore, the likelihood that someone hacked and exfiltrated the data with malicious intent is low, as there would be no reason to store stolen data on a global security website that logs traces. In other words, unless it was an intentional whistleblower leak, it is highly likely an accident caused by an uploader who did not understand the platform's operational mechanism.

Even if a leak of classified information occurred, it is baffling that the government's security systems failed to notice it, leaving it neglected for five months. It shows that despite being a situation that could easily happen, there were no countermeasures in place.

① Blind Spots in Data Loss Prevention (DLP) Systems

Internal networks at government agencies constantly monitor for external leaks. However, this incident exposed limitations in detecting unauthorized activities in real time when work PCs are not separated from the external internet or when an official uploads files through a web browser without going through export approval procedures.

② The Uploader's Oversight and Inaction

The person who uploaded the data most likely only looked at the green screen indicating "No threats found." They likely closed the browser without considering what happens afterward. Because they were unaware that the file would remain on the server and be downloadable by paid subscribers, it is presumed they took no action to request deletion or report the incident.

③ Absence of External Intelligence Monitoring

There was no specialized system operating beforehand to continuously monitor whether keywords or document formats containing information on key figures, such as the head of state, appeared on major open-source intelligence platforms like VirusTotal. Structurally, it was difficult for internal authorities to detect until domestic and international security researchers or monitoring entities belatedly identified and reported it.

Cheong Wa Dae has belatedly scrambled into action. On Tuesday morning, an emergency meeting was convened, presided over by Presidential Chief of Staff Lim Gwang-hyun. Lim raised his voice, emphasizing that "the leak of personal information regarding the presidential delegation is a grave matter that can by no means be taken lightly." Senior Presidential Spokesperson Kang Yu-jung reported that Lim stressed the need to "thoroughly investigate the circumstances of the leak, the scope of information exposure, and any actual harm, while clearly establishing the managerial responsibilities of relevant agencies." Lim also reportedly ordered relevant agencies to conduct a comprehensive review of the security management system for presidential tours and establish effective measures to prevent recurrence.

However, to ensure this does not end up as an empty attempt to "mend the barn after the horse has bolted," the security systems of key national institutions must be thoroughly audited and overhauled. Even if South Korea cannot match a certain foreign power known to immediately initiate wiretapping and eavesdropping wherever its head of state's name is mentioned anywhere in the world, having the president's personal information left rolling around in public for five months makes no sense at all.

※