Seoul races to contain data leak exposing Lee, his aides and bodyguards

South Korea is scrambling to contain an unprecedented leak that exposed the personal information of President Lee Jae Myung and first lady Kim Hea Kyung, as well as senior aides, bodyguards and journalists accompanying them overseas.

The exposure of the first couple's personal information was alarming enough. But the breach also revealed the identities of presidential security officers assigned to protect the president at close range, raising deeper concerns about presidential security.

The government has launched an investigation and moved to limit any potential damage, including the reissuance of passports for Lee and the first lady. Cheong Wa Dae has also ordered a sweeping review of security protocols for presidential overseas trips and measures to prevent another breach.

The breach, reported by local broadcaster KBS on Monday, exposed sensitive personal information belonging to 168 people aboard the presidential aircraft over a period of about five months.

The data, including names in Korean and English, affiliations, job titles, dates of birth, passport numbers and passport issuance and expiration dates, had been uploaded to a cybersecurity website a week before Lee departed for Europe in June.

The disclosure has sent alarm bells ringing over presidential security, raising urgent questions about how such sensitive information remained exposed for months and prompting a swift government response.

Foreign Ministry spokesperson Park Doo-soon outlined the circumstances surrounding the leak and the government's response at an emergency news briefing broadcast live Tuesday morning.

“The Foreign Ministry requested an investigation and inquiry by relevant authorities immediately after confirming the leak in advance, and is currently conducting an investigation to determine how the information was leaked, in cooperation with relevant agencies, including the National Police Agency,” Park said.

Park said the ministry had been aware of the leak before the KBS report was published, but declined to specify exactly when officials first learned of the breach.

“We are conducting a comprehensive and in-depth investigation, including technical inspections of computers and emails related to the president’s overseas trip in June," Park added.

Park further explained that the government had taken steps to prevent further damage, including removing the leaked information from the website in question and checking whether any additional personal data had been exposed.

“Based on what we have determined so far, we have not identified any further spread or dissemination of the leaked information,” Park said.

The government is “swiftly implementing measures to ensure the smooth reissuance of passports for all those affected, including the president and first lady,” Park said.

The Korea Herald learned from government sources that the information appears to have been leaked from an agency other than Cheong Wa Dae and that the National Intelligence Service is involved in the investigation.

According to KBS, a file containing a passenger list for South Korea's presidential aircraft, known as Air Force One, was uploaded to a cybersecurity website on June 2, a week before Lee departed for Europe.

The passenger list is believed to correspond to Lee's June 9 departure for Brussels on a trip that included summits with Belgium and the European Union, the G7 summit in Evian, France, and a state visit to Italy.

The file contained personal information belonging to senior government officials, including then-presidential policy chief Kim Yong-beom, national security adviser Wi Sung-lac and several Cabinet ministers, including Foreign Minister Cho Hyun.

The list also identified presidential guards whose identities are normally kept confidential, medical personnel accompanying the president, working-level officials from Cheong Wa Dae and the Foreign Ministry, and journalists covering the trip.

The disclosure raised concerns about potential risks to presidential security, as the identities of those working in close proximity to the president were exposed along with their personal details.

KBS reported that paid subscribers and antivirus companies could download the file without restrictions, making it difficult to determine who may have accessed the sensitive information.

The broadcaster said it verified the authenticity of some of the leaked information by cross-checking passport numbers and dates of birth with those of individuals named in the file.

Cheong Wa Dae did not dispute the KBS report.

The Foreign Ministry, however, suggested it was treating the incident as a possible data leak rather than a hacking attack, without confirming whether the information had been disclosed accidentally or deliberately.

Park said, “We regard this as a data leak.”

Asked about a local media report suggesting that an employee at the Foreign Ministry's protocol office had uploaded the passenger list to a cybersecurity company's website, where it remained exposed for months, Park declined to confirm the allegation.

He said, “An investigation into the matter is currently underway.”

Park emphasized that “the Foreign Ministry takes this matter very seriously and will take a range of measures to prevent further damage and similar incidents, while conducting a thorough investigation to identify and analyze the cause of the leak.”

The Foreign Ministry's announcement came after presidential chief of staff Lim Kwang-hyun convened an emergency meeting Tuesday morning to discuss the incident, according to a written statement issued by senior presidential spokesperson Kang Yu-jung.

During the meeting, Lim said that the leak of personal information belonging to members of the presidential delegation traveling overseas was "a serious matter that must not be taken lightly."

Lim called for a "thorough investigation into how the information was leaked, the extent of the exposure and whether any actual damage had occurred," according to Kang.

Lim also stressed the need to "clearly establish the responsibility of the relevant agencies" for the personal data leak.

Lim called on the relevant agencies to "conduct a comprehensive review of security protocols for presidential overseas trips and devise effective measures to prevent similar incidents," Kang added.