MediumII Cyber Warfare & Critical Infrastructure3 November 2026, Tuesday

Korean president's passport details left exposed on malware site for months

A passenger list containing the passport numbers and dates of birth of 168 people, including President Lee Jae-myung, was uploaded to a malware-scanning site on 2 June and stayed accessible for about 5 months. The Foreign Ministry asked police to investigate on 3 November.

Location: SEOUL

According to SBS on 3 November, the file titled 'Passenger List (Korea–Belgium)' was uploaded before Lee's June tour of Belgium, Italy and France. The list included the presidential couple, National Security Adviser Wi Sung-lac, 3 ministers, Presidential Security Service agents and journalists. The exposed fields were name, title, date of birth, passport number and the passport's 2 validity dates.

According to AFP, the file was uploaded to VirusTotal; SBS describes this 1 platform as a paid site that scans files and addresses for malware. Foreign Ministry spokesperson Park Doo-soon said on 3 November that all affected passports had been reissued. The ministry is treating the 168-person incident as a leak rather than an attack and is examining the computers and email accounts used to plan the trip.

According to a 4 November editorial in the Seoul Economic Daily, an attack on the Korea National Diplomatic Academy in July exposed data on 10,000 people. The same editorial says Lee, after the 168-person leak, called for a strong cybersecurity coordination body covering both the public and private sectors. A government that demands heavy penalties on companies for personal data breaches learned of its own 168-person lapse from the press.

Talay assessment

Bottom line

This is a process failure more than an attack: the head of state's travel list stayed open to third parties for 5 months through a routine malware scan. As the Seoul Economic Daily noted, North Korea runs state-level cyber units, which raises the list's value for targeted phishing. The most likely outcome is the rapid creation of a central cyber coordination body in Seoul.

Likely effects

Targeted phishingNegativeWeeks
Titles, dates of birth and passport details make it easier for state-backed groups to forge documents and emails aimed at senior officials.
Public cyber governanceUncertain1–6 months
The coordination body Lee wants would pull scattered ministerial powers into one centre and bring forward public IT budgets.
Cloud scanning toolsUncertain1–6 months
Institutions will restrict uploading documents to file-scanning platforms, and demand for in-house scanning tools will rise.

Possibilities, ranked

1
Coordination body is set up55%
By year-end the government unveils a draft cybersecurity coordination body spanning the public and private sectors.
Watch: The presidential office's draft cybersecurity organisation
2
A second leak is confirmed30%
An official investigation confirms that other Foreign Ministry documents were also exposed.
Watch: Findings of the Korean National Police Agency investigation
3
The issue cools15%
The incident closes with the reissued passports and institutional change is postponed.
Watch: The agenda of the National Assembly's foreign affairs committee

Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.

Market reaction

Indicators affected

People exposed▼ 168
Exposure period▼ ≈5 months
July academy breach▼ 10,000 people

Bottom line

Likely effects

Possibilities, ranked

Sources