South Korea probes leak of presidential plane passenger data, 168 affected
Synopsis
A routine malware scan inadvertently exposed the passport details, birthdates, and affiliations of 168 people — including South Korean President Lee Jae Myung and his wife — for nearly five months. What began as a preliminary inquiry has now escalated into a formal criminal investigation, raising hard questions about security protocols around presidential travel data.
Key Takeaways
South Korean police launched a formal criminal investigation on 3 November 2026 into the leak of personal data of 168 individuals .
Those affected include President Lee Jae Myung , his wife, Cabinet ministers, Presidential Security Service members, and journalists.
The file — a passenger list from Lee's Belgium, Italy, and France tour — was uploaded on 2 June to a malware-scanning platform and remained accessible for roughly five months .
Leaked data reportedly includes names, affiliations, job titles, dates of birth, and passport numbers with issuance and expiration dates.
The foreign ministry has reported the breach to the Personal Information Protection Commission , which plans to verify the details.
South Korean police have launched a formal criminal investigation into the online leak of sensitive personal information belonging to 168 individuals, including President Lee Jae Myung, his wife, and senior Cabinet ministers. The probe, announced on Tuesday, 3 November 2026, follows what authorities describe as an inadvertent exposure of classified travel records on a publicly accessible security platform.
How the Leak Occurred
According to the Korean National Police Agency, a file titled 'Passenger list (South Korea-Belgium)' was uploaded to a paid, security-related website on 2 June, ahead of President Lee's official overseas tour. The platform in question allows users to scan files or web addresses for malicious code — paid members and general users alike can reportedly download files uploaded to it. Investigators suspect the passenger list was exposed during a routine malware scan, when the file was inadvertently made accessible to other platform users.
What the File Contained
The leaked document reportedly included highly sensitive personal details of individuals aboard the presidential aircraft during Lee's visits to Belgium, Italy, and France in June. Those affected include key government officials, staff members of Cheong Wa Dae (the presidential office) and the foreign ministry, members of the Presidential Security Service, and journalists covering the presidential beat. According to reports, the exposed data comprised names in both Korean and English, affiliations, job titles, dates of birth, passport numbers, and passport issuance and expiration dates — a trove of information that could pose significant security and identity risks.
Five Months of Undetected Exposure
The file reportedly remained accessible for approximately five months after being uploaded on 2 June before it was finally taken down. The prolonged window of exposure has drawn sharp scrutiny over the adequacy of security protocols surrounding presidential travel documentation. Police had earlier opened a preliminary probe; the upgrade to a formal criminal investigation signals that authorities now believe a criminal violation may have occurred.
Government Response and Oversight Steps
Cheong Wa Dae confirmed it became aware of the breach and said responsive measures have been put in place. The foreign ministry, which is conducting its own parallel inquiry, separately notified the country's privacy watchdog — the Personal Information Protection Commission — on Tuesday. An official at the Commission stated the agency plans to verify the details of the leak based on the report filed. This comes amid growing global concern over the vulnerability of government travel data to incidental exposure through third-party digital tools.
What Happens Next
Investigators are expected to trace the chain of custody of the file — determining who uploaded it, through which device, and whether internal protocols were violated. The Personal Information Protection Commission will run a separate administrative inquiry alongside the criminal probe. With passport details of senior officials exposed for months, security analysts warn of potential risks ranging from identity fraud to targeted foreign intelligence operations.
Point of View
Apparently undetected. That points less to a deliberate breach and more to a systemic failure in how classified travel documents are handled digitally — particularly when routed through third-party security tools that were not designed for state-level confidentiality. Governments worldwide routinely use commercial malware-scanning services without adequately vetting their data-retention and access policies; South Korea's case may be a cautionary example that others recognise uncomfortably well. The criminal investigation must answer not just who uploaded the file, but why no internal audit flagged the exposure for nearly half a year.
NationPress
3 Nov 2026
Frequently Asked Questions
What personal data was leaked in the South Korea presidential plane passenger list incident?
The leaked file reportedly contained names in Korean and English, affiliations, job titles, dates of birth, passport numbers, and passport issuance and expiration dates of 168 individuals. Those affected included President Lee Jae Myung, his wife, Cabinet ministers, Presidential Security Service members, and journalists covering the presidential office.
How did the South Korean presidential passenger list end up online?
Police suspect the file was uploaded to a paid, security-related malware-scanning website on 2 June, inadvertently exposing it during a routine check for malicious code. The platform allows users to download files uploaded by others, meaning the data became accessible beyond its intended recipients.
How long was the leaked file accessible?
The file reportedly remained accessible for approximately five months after being uploaded on 2 June before it was taken down. The prolonged exposure has raised serious questions about security protocols for presidential travel documents.
What action has the South Korean government taken?
Cheong Wa Dae said it has taken responsive measures after becoming aware of the breach. Police have upgraded from a preliminary probe to a formal criminal investigation, the foreign ministry is conducting a parallel inquiry, and the Personal Information Protection Commission has been formally notified and plans to verify the details.
Who is affected by the South Korea presidential data leak?
A total of 168 people are affected, including President Lee Jae Myung and his wife, key Cabinet ministers, staff of Cheong Wa Dae and the foreign ministry, Presidential Security Service members, and journalists who travel with the presidential delegation.
