List included president, first lady, ministers and security detail; leak went undetected until media inquiry

Foreign Ministry suspected as source; police and privacy watchdog launch probes

President Lee Jae Myung and first lady Kim Hye-kyung wave to well-wishers from Air Force One at Seoul Airport in Seongnam, Gyeonggi Province, on Sept. 21, before departing to attend the UN General Assembly and make a state visit to Mexico. [Yonhap]
President Lee Jae Myung and first lady Kim Hye-kyung wave to well-wishers from Air Force One at Seoul Airport in Seongnam, Gyeonggi Province, on Sept. 21, before departing to attend the UN General Assembly and make a state visit to Mexico. [Yonhap]

Sensitive personal data — including passport numbers and dates of birth — belonging to 168 passengers aboard Air Force One were left exposed online for five months without detection, raising alarm over gaps in national security and presidential protection. The leaked file revealed not only the identities of the president, his wife and cabinet ministers, but also those of close-protection agents and food-safety inspectors whose identities are normally kept confidential, with the data accessible online a full week before the overseas trip began.

According to government and police sources Wednesday, an Excel file containing information on 168 people who accompanied President Lee Jae Myung on his European tour was uploaded to the malware-scanning site VirusTotal on June 2. The file included the names, affiliations, titles, dates of birth, passport numbers, and passport issuance and expiration dates of Lee and his wife, Cheong Wa Dae National Security Director Wi Sung-lac, then-Minister of SMEs and Startups Han Sung-sook — now prime minister — along with other senior officials, Cheong Wa Dae and Foreign Ministry staff, security personnel and the press pool.

The government failed to detect the leak for five months, learning of it only just before media outlets reported on it — a lapse that has drawn sharp criticism as a security failure. The Ministry of Foreign Affairs said a system review found no signs of external intrusion, leading officials to suspect an insider leak rather than a hack. The file's author field listed "mofa," the ministry's official English abbreviation. A Foreign Ministry official said the document matched the ministry's format — an Excel sheet rather than a formal official document, but similar to forms the ministry uses — and noted that the ministry, as the coordinating agency for presidential overseas trips, is responsible for compiling such information. The document was accessible only to authorized personnel within the ministry's protocol office.

The Korean National Police Agency's Cyber Terror Investigation Unit opened an investigation on charges of violating the Personal Information Protection Act, and the Personal Information Protection Commission launched its own ex officio probe to establish the facts. Foreign Ministry Spokesperson Park Du-soon said the ministry had immediately requested investigations from relevant agencies upon confirming the leak, and that it was working with the police agency and other bodies to determine how the data was disclosed.

The government moved to have the data removed from the site and to reissue passports for those affected, while Cheong Wa Dae said it would conduct a comprehensive review of its overseas-trip security management. Critics noted, however, that third parties may already have obtained the information during the five months it was publicly accessible, and that Cheong Wa Dae's response — which emphasized its role as a victim rather than acknowledging management failures — has drawn further criticism over lax oversight.


sunpine@heraldcorp.com