South Korea’s Foreign Ministry is investigating whether an outside cybersecurity contractor may have been behind the leak of a presidential delegation passenger list, as additional files believed to be ministry documents were found uploaded to the same overseas malware-scanning platform.
The ministry said Thursday it was examining “all possibilities” after reports that the passenger list, which contained personal information on President Lee Jae Myung, the first lady and other members of his June trip to Europe, may have been exposed through a company contracted to monitor the ministry’s internal network.
“We are conducting a thorough investigation from multiple angles, with all possibilities in mind,” the ministry said in a statement, adding that it was working with police and other relevant authorities.
The ministry said it was taking the possible leak of diplomatic materials seriously and would disclose its findings once the facts were established.
Earlier, a local broadcaster reported that authorities believe the passenger list may have been uploaded to VirusTotal, an online malware-scanning platform, through the contractor handling security monitoring for the ministry.
The file contained personal information on 168 members of the delegation, including Lee and his wife, presidential aides, Cabinet ministers and security personnel, and was reportedly exposed on the platform for about five months.
At least two other files believed to be related to Foreign Ministry work were also found on VirusTotal. They include a meeting request related to the International Court of Justice and a power-of-attorney document used for visa work at an overseas diplomatic mission.
Uploaded records were also found for files apparently linked to the Asia-Pacific Economic Cooperation forum and military education-related work.
Police have opened a formal investigation into possible violations of the Personal Information Protection Act.
Authorities are also examining other possible routes of the leak, including South Korean diplomatic missions and foreign governments that received the passenger information.
Investigators are reportedly looking into whether the file was exposed while the South Korean Embassy in Belgium was transmitting the passenger list to the Belgian Foreign Ministry.
The ministry has yet to determine how the files were uploaded or whether the incidents are connected.
cheesuk@heraldcorp.com
