South Korea presidential office leak: passport data of 168 on President Lee's June trip posted online
Severity: high · Patch status: no-fix-needed · Since 2026-11-03
A file with personal details of 168 people on President Lee Jae Myung's June 2026 overseas trip, including the President and the First Lady, was uploaded on 2026-06-02 to VirusTotal, a malware-scanning website, a week before the 9 June departure for a 10-day Belgium, Italy and France trip that included the G7 summit (JoongAng Daily). The reported fields are birth dates, passport numbers and passport issuance and expiry dates. JoongAng Daily names Prime Minister Han Seong-sook and National Security Adviser Wi Sung-lac among those affected; Korea Herald gives a wider list, including ministers, presidential officials, journalists and then-policy chief Kim Yong-beom, attributing it to earlier reports. On Tuesday 2026-11-03 the Foreign Ministry said the leak is presently believed to stem from internal mishandling of documents rather than a hack, and that it is checking whether documents held by its protocol office were deliberately leaked. Chief of Staff Lim Kwang-hyun chaired an emergency meeting the same day and ordered a probe into who is responsible. The ministry says the information was removed from the site in question and has seen no further spread so far. The presidential office says it took measures after learning of the matter in advance.
What to do
- Establish whether the 2026-06-02 upload was internal mishandling or a deliberate leak from the Foreign Ministry protocol office, and close the path that allowed it
- Verify the file is gone from every site it was posted to and check for copies, since the ministry says only that it was removed from the site in question
- Notify the 168 people, give passport holders guidance on exposed passport numbers, and assess security risks to the officials named
- Review access controls and handling procedures for overseas-trip personnel and passport data in the presidential office and the Foreign Ministry protocol office
- Audit other government systems for similarly exposed personal data
Sources
All live incidents on Threat Watch
