Seoul scrambles to limit damage after Lee's passport info leaked

South Korea is scrambling to contain an unprecedented leak that exposed the personal information of President Lee Jae Myung and first lady Kim Hea Kyung, as well as senior aides, bodyguards and journalists accompanying them overseas.

The exposure of the first couple's personal information was alarming enough. But the breach also revealed the identities of presidential security officers assigned to protect Lee at close range, raising deeper concerns about presidential security.

The government has launched an investigation and moved to limit any potential damage, including the reissuance of passports for Lee and the first lady. Cheong Wa Dae has also ordered a sweeping review of security protocols for presidential overseas trips and measures to prevent another breach.

The breach, reported by local broadcaster KBS on Monday, exposed sensitive personal information belonging to 168 people aboard the presidential aircraft over a period of about five months.

The data, including names in Korean and English, affiliations, job titles, dates of birth, passport numbers and passport issuance and expiration dates, had been uploaded to a cybersecurity website a week before Lee departed for Europe in June.

One possibility being examined by the Foreign Ministry is that the leaked document originated from its protocol office, which oversees presidential overseas trips.

"The Foreign Ministry's protocol office is the working-level department responsible for presidential summits. It is also in charge of managing the passenger list for the presidential aircraft and handling related documents in accordance with security requirements," a Foreign Ministry official in Seoul said Tuesday on condition of anonymity.

The official acknowledged that the leaked file "resembles the format of documents prepared by the Foreign Ministry," but explained that it was an Excel spreadsheet rather than a formal government document bearing an official seal.

"It is difficult to say definitively whether it is a Foreign Ministry document or not," the official said, citing the ongoing investigation.

Asked whether the ministry's protocol office and relevant diplomatic missions were the primary focus of the internal investigation, the official replied, "They are likely to be the main focus."

Asked whether sensitive documents, including presidential aircraft passenger lists, were routinely uploaded to external websites for malware scans, the official said, "The protocol office has no such protocol," adding that ministry staff generally do not use such sites for that purpose.

Regarding whether private contractors involved in presidential overseas trips could access such documents, the official said, "Only personnel with the required security clearance can access them."

The official added that investigators were keeping open the possibility that the documents had been leaked from within the Foreign Ministry, while the source and circumstances of the breach remained under investigation.

Foreign Ministry spokesperson Park Doo-soon said at an emergency briefing Tuesday that the ministry had requested an investigation immediately after learning of the leak, before KBS published its report.

"We are conducting a comprehensive and in-depth investigation, including technical inspections of computers and emails related to the president's overseas trip in June," Park said.

The ministry is working with the National Police Agency and other relevant authorities to trace the leak, while seeking to prevent further dissemination of the information.

"Based on what we have determined so far, we have not identified any further spread or dissemination of the leaked information," Park said.

The government has also begun reissuing passports for those affected. At a regular briefing later Tuesday, Park confirmed that new passports had been issued for the president and first lady.

The Korea Herald learned from government sources that the information appears to have been leaked from an agency other than Cheong Wa Dae and that the National Intelligence Service is involved in the investigation.

According to KBS, a file containing a passenger list for South Korea's presidential aircraft was uploaded to a cybersecurity website on June 2.

The list is believed to correspond to Lee's June 9 departure for Brussels on a trip that included summits with Belgium and the European Union, the G7 summit in Evian, France, and a state visit to Italy.

The file contained personal information belonging to senior government officials, including then-presidential policy chief Kim Yong-beom, national security adviser Wi Sung-lac and several Cabinet ministers, including Foreign Minister Cho Hyun.

It also identified presidential guards whose identities are normally kept confidential, medical personnel accompanying the president, working-level officials and journalists covering the trip.

KBS reported that paid subscribers and antivirus companies could download the file without restrictions, making it difficult to determine who may have accessed the sensitive information. The broadcaster said it verified some of the leaked details by cross-checking passport numbers and dates of birth.

Cheong Wa Dae did not dispute the KBS report.

The Foreign Ministry, however, did not confirm whether the information had been disclosed accidentally or deliberately.

During an emergency press briefing convened to address the matter, Park said the ministry is treating the issue "as a data leak,” but emphasized that “the Foreign Ministry takes this matter very seriously and will take a range of measures to prevent further damage and similar incidents, while conducting a thorough investigation to identify and analyze the cause of the leak.”

The Foreign Ministry's announcement came after presidential chief of staff Lim Kwang-hyun convened an emergency meeting Tuesday morning to discuss the incident, according to a written statement issued by senior presidential spokesperson Kang Yu-jung.

During the meeting, Lim said that the leak of personal information belonging to members of the presidential delegation traveling overseas was "a serious matter that must not be taken lightly."

Lim called for a "thorough investigation into how the information was leaked, the extent of the exposure and whether any actual damage had occurred," according to Kang.

Lim also stressed the need to "clearly establish the responsibility of the relevant agencies" for the personal data leak.

Lim called on the relevant agencies to "conduct a comprehensive review of security protocols for presidential overseas trips and devise effective measures to prevent similar incidents," Kang added.