A Malware Scan Gone Wrong? Passport Data of Lee Jae Myung’s Travel Party Sat Online for Five Months
Most data leaks start with an attacker. This one, as far as is known so far, started with a file being uploaded to a security tool. South Korea’s presidential office is now investigating how the passenger list for President Lee Jae Myung’s aircraft ended up exposed online, and the answer could become a lesson for every government office that handles sensitive documents.
What was exposed
According to broadcaster KBS, the list covered 168 people who flew on the presidential plane during Lee’s visits to Belgium, France and Italy in June. It was posted on a subscription-based cybersecurity platform on June 2, a week before the delegation departed, and remained accessible for about five months.
The details were exactly the kind that security services try hardest to protect: names, job titles, birth dates and passport information. Among those listed were the president, first lady Kim Hea Kyung, then-Director of National Policy Kim Yong-beom, National Security Adviser Wi Sung-lac, Science and ICT Minister Bae Kyung-hoon and Foreign Minister Cho Hyun. The list also included people whose identities are normally kept out of public view: secret service agents, the president’s medical team and the staff responsible for the president’s and first lady’s hair and make-up, as well as journalists travelling with the delegation.
The response
On Tuesday, presidential chief of staff Lim Kwang-hyun convened an emergency meeting, and Cheong Wa Dae ordered a thorough investigation. Police have opened a formal inquiry. At a Cabinet meeting the same day, Lee went further than the single incident, calling for a fundamental overhaul of the country’s cybersecurity system and suggesting a government-wide “cybersecurity czar” body that could coordinate protection across the public and private sectors.
The uncomfortable lesson
Online scanning services are popular for a simple reason: they let anyone check whether a file is dangerous in seconds. The catch is that uploading a document to an external platform can mean sharing it with that platform’s other users. A cybersecurity industry source told KBS that organisations should scan sensitive files on isolated networks or build internal screening systems, warning that hostile states can exploit such information when it surfaces before important events.
That is the part of the story that travels beyond Seoul. The tools meant to keep files safe can become the route through which they leak, if staff are not trained to know the difference between checking a file and publishing it.