The Kyunghyang Shinmun reported on the 2nd, citing KBS, that a file holding personal data on 168 Air Force One passengers, including President Lee Jae-myung and the first lady, had been posted on an outside website. It was reportedly uploaded to a paid malware-scanning site, which News1 summarized as VirusTotal. The posting is said to date to about a week before the president left for Europe on June 9.

The top row of the file read ´the president and first lady´, and it reportedly included their birth dates, passport numbers, and passport issue and expiry dates. The Kyunghyang Shinmun said accompanying ministers, the national security adviser and the then policy chief also had their birth dates and passport numbers listed.

The exposure was not limited to senior officials. Security staff, medical personnel, makeup and wardrobe staff, the person who checks the president´s food in advance, and presidential press-corps reporters who covered the June EU summit, Italy state visit and G7 summit were reportedly on the list too.

Presidential office: ´knew in advance, responded´

The presidential office said it ´recognized the matter in advance and took response measures, with the foreign ministry and others to take further steps´. When it became aware, and what exactly it did, were not stated in the reports we checked. That remains unconfirmed.

According to News1, the office leans toward the view that the leak occurred while the list of the travelling delegation was being compiled. Police have opened an investigation, and the foreign ministry says it takes the matter seriously and is investigating from several angles. Who uploaded the file and by what exact route have not been confirmed.

Legal issues and fallout

Passport numbers and birth dates, combined with other information, can be misused for impersonation or targeted attacks. The reports also raised concern that hostile states could use them for intelligence gathering. Specific legal findings under the Personal Information Protection Act, such as liability or fines, did not appear in the reports we checked and are likewise unconfirmed.

Ironically, on September 30 President Lee urged companies handling personal data on social media to strengthen protection staff and systems, warning of heavier fines, criminal penalties and class-action damages for violations. That is the backdrop for calls to hold the government to its own standard.

A third view

A third view. Security specialists generally hold that sending trip lists containing passport data by email, messenger or external file-scanning services is itself risky, and the commonly understood practice for leaders´ foreign trips is to share passenger data only with the agencies that need it. However, our search found no specific case of another country´s leader-aircraft passenger data being exposed in a similar way, so this rests on general security principles. Preventive measures and any accountability have not been announced.