South Korea to Reissue 168 Passports After President Lee’s Details Sat Exposed Online for Five Months

South Korea is reissuing the passports of its president, his wife, his cabinet ministers and his bodyguards after a file containing their passport numbers, dates of birth and job titles sat exposed on a paid file-analysis website for almost five months, according to the country’s foreign ministry. Police in Seoul opened a formal investigation into the leak on Tuesday, a day after the country’s public broadcaster first reported the exposure.

The file, an Excel spreadsheet titled “Passenger List (Republic of Korea-Belgium)”, listed 168 people who travelled on the presidential aircraft for President Lee Jae Myung’s overseas trip to Europe in June, according to KBS, the broadcaster that discovered the document. It contained names in Korean and English, affiliations, positions, dates of birth, passport numbers and passport issue and expiry dates. Among those named were the first lady, Kim Hye-kyung, cabinet ministers, National Security Office officials, presidential office staff, members of the Presidential Security Service and journalists who accompanied the head of state.

The file had been available since 2 June, about a week before the president began the trip, and remained accessible until shortly after media reports surfaced this week, when access was blocked and the file deleted. The foreign ministry said on Tuesday that it was moving to reissue passports for all 168 people affected, and that it had found no evidence so far that the information had spread further.

The leak has become a political row within hours of its disclosure. The main opposition People Power Party called it a “security disaster”, while the ruling Democratic Party accused the opposition of politicising the incident and urged the public to wait for the results of the official investigation. The presidential office, known as the Blue House, convened an emergency meeting on Tuesday to review security procedures for presidential travel.

What was exposed

The spreadsheet was the passenger manifest for the presidential aircraft — known in South Korea as Air Force One — for a trip that took President Lee to Belgium and Italy and to the Group of Seven summit in France between 9 and 18 June, according to Reuters. It was a classified document prepared ahead of the journey, and its format matched the foreign ministry’s own documents, the ministry said.

The 168 people listed were not only the most senior figures in the government. The file also named security planning officials, escort personnel and members of the president’s protection detail, medical staff, aides and support workers — including, according to one report, the person responsible for checking the president’s food before it was served — and members of the press corps travelling with the delegation.

Among the senior officials named were the first lady, Kim Hye-kyung; the minister of science and ICT, Lee Kwang-hoon; the foreign minister, Park Jin; the director of the National Security Office, Wi Sung-lak; and the former chief of policy, Kim Yong-beom, according to Aju Press and the Seoul Economic Daily.

Passport numbers combined with dates of birth and full names are among the most useful ingredients for identity theft and fraud, and the exposure of the identities and roles of presidential security personnel carries a different order of risk. Knowing who guards a head of state, who plans his security and who travels in his medical team gives a hostile actor a map of the protective apparatus around him. That is why the opposition’s criticism has focused less on the president’s own details — a head of state’s name and face are public by definition — and more on the people around him whose identities are supposed to stay out of public view.

There is no indication so far that the information was used for any malicious purpose. A foreign ministry official told reporters on Tuesday that there was no evidence the details had spread further, and the ministry said it had taken steps to have the information removed from the website and to prevent further exposure. But five months is a long time for a file to sit on a platform whose paying subscribers can download whatever has been uploaded to it, and the government cannot know with certainty who may have copied it during that window.

How the file ended up online

The file was uploaded in early June to a paid website that scans files for malware, according to KBS, which first reported the leak on Monday. The Seoul Economic Daily identified the site as VirusTotal, an external malware-scanning service where uploaded files can be downloaded by paying members. The file is believed to have been posted in the course of checking whether the passenger list was infected with malware, ahead of the president’s trip — in other words, a routine security check may have been the very act that exposed the data.

How the file reached the platform, and who uploaded it, has not been established. The foreign ministry said on Tuesday that it viewed the case as a leak rather than a hacking incident, and that technical inspections of the computers and email accounts used in connection with the trip had found no abnormal access. There has been no report of a claim by a cybercriminal group, no ransom demand and no official attribution to state actors or advanced persistent threat groups, and the ministry said it had found no sign that its systems had been breached.

KBS said it had informed the presidential office after discovering the information online. The foreign ministry, which compiles and manages the passenger list for the presidential aircraft, said it learned of the exposure a day earlier and began tracing how it happened in cooperation with the National Police Agency and other agencies. It formally reported the leak to the Personal Information Protection Commission, South Korea’s data protection regulator, which said it would verify the facts on the basis of the report submitted.

Police began a preliminary inquiry on Monday, after the foreign ministry sent an official letter requesting an investigation on the evening of 2 November. On Tuesday, police announced that they had moved from a preliminary inquiry to a formal investigation, just one day after the initial inquiry began. The investigation will seek to establish how the personal information came to be posted on an outside website and how it leaked, and an internal ministry review will run in parallel.

The government scrambles to respond

The response from the government on Tuesday was swift and visible. The foreign ministry’s spokesperson, Park Doo-soon, held a briefing at the ministry’s headquarters in Seoul on the morning of 3 November, telling reporters that officials currently viewed the case as a leak rather than hacking, that passports would be reissued for all 168 people, and that the ministry was conducting an inquiry into how the document leaked with the cooperation of the National Police Agency and other relevant agencies.

The Blue House convened an urgent meeting chaired by Chief of Staff Lim Kwang-hyun to conduct a comprehensive review of security management protocols for presidential trips and to establish measures to prevent similar incidents. The presidential office said it had taken necessary measures after becoming aware of the data leak.

The reissue of 168 passports, including those of the president and the first lady, is itself a measure of how seriously Seoul is taking the incident. A passport number, once exposed, cannot simply be recalled: the document itself must be replaced. For the most senior officials in the country, that means new travel documents, new records with airlines and border authorities, and a quiet administrative operation carried out under public scrutiny.

Yet the speed of the response also raises an awkward question. The file was uploaded on 2 June and sat on a publicly accessible platform for about five months. The government says it acted as soon as it became aware of the exposure, and there is no suggestion that officials knew about it earlier and sat on it. But the fact that a classified passenger list could sit in plain sight for five months without anyone in the presidential office or the foreign ministry noticing is, for the opposition, the heart of the scandal.

The political fallout

The People Power Party, the main opposition, moved quickly to frame the leak as a failure of basic competence at the top of government. Its spokesperson, Cho Yong-sool, said in a commentary on Tuesday that the leak of key information related to a presidential overseas trip amounted to “a security disaster akin to leaving the door wide-open to an enemy or a terrorist group”.

“What is more concerning is that the identities of security personnel, medical staff and aides assisting the president were also exposed,” Cho added. He called on President Lee to issue an apology for the presidential office’s “lax discipline” and stressed the need to hold those responsible accountable.

The party’s leader, Jang Dong-hyeok, joined the criticism on Facebook, turning the president’s own words against him. Lee has previously said that penalties for personal data breaches should be tough enough that companies fear being run out of business. “It is now the presidential office’s turn to go down?” Jang wrote, according to the Korea JoongAng Daily.

The ruling Democratic Party pushed back. Its floor spokesperson, Lee Ju-hee, said in a written press briefing that the government had immediately deleted the information posted on the website and taken proactive measures to prevent further damage, including checking whether additional data had been leaked. “For the PPP to be a responsible opposition party, it should stop turning everything into a political issue and fueling public anxiety, but rather wait for the results of the government investigation and support measures to prevent similar incidents from happening again,” she said.

The exchange captures a familiar dynamic in South Korean politics, where data breaches and security lapses are quickly absorbed into partisan combat. But it also underlines a particular vulnerability for Lee. He came to office promising to restore discipline and accountability to a presidency badly damaged by his predecessor’s attempt to impose martial law, and his government has made a public virtue of tough enforcement against companies that mishandle personal data. A breach inside his own office, affecting his own staff, is difficult to present as someone else’s failure.

A president who promised accountability

Lee Jae Myung was sworn in as president in June 2025 after winning a snap election with 49.42 per cent of the vote, defeating the People Power Party’s Kim Moon-soo, who secured 41.15 per cent. Turnout was 79.4 per cent, the highest since 1997. The election was held six months after his predecessor, Yoon Suk Yeol, shocked the country by declaring martial law in December 2024 — a move that triggered mass protests, Yoon’s impeachment and his removal from office by the Constitutional Court in a unanimous 8-0 decision in April 2025.

Lee, who had narrowly lost the 2022 presidential election to Yoon by less than one percentage point, took office immediately, without a transition period, pledging to recover democracy and heal national divisions. His approval rating stayed above 55 per cent for most of his first year and peaked at 67.5 per cent in April 2026, according to the Executive Approval Project. That extended honeymoon has faded since the local elections of June 2026, in which his Democratic Party won a majority of local and legislative races but lost the Seoul mayoral race and two key legislative contests.

The June trip at the centre of the leak was one of Lee’s first major outings on the world stage — a debut at the Group of Seven summit and visits to European capitals, barely a year into a presidency defined by the clean-up after the martial law crisis. The irony that a document from that trip, prepared with the care that attends a new president’s first summit, should have been the one to end up on a public website will not be lost on his critics.

South Korea’s presidents serve a single five-year term, so Lee cannot seek re-election in 2030. That concentrates the political cost of scandals like this one: there is no second campaign in which to recover, only the remainder of a term in which the government’s competence is judged day by day. A data leak is not a constitutional crisis, and it is not in the same category as the martial law episode that brought Lee to power. But it is the kind of incident that erodes the quiet confidence on which a presidency rests.

Security on the peninsula, under strain

The leak comes at a moment when South Korea’s security apparatus is under pressure on more than one front. On the same day the formal police investigation was announced, North Korea said it had tested a strategic cruise missile carrying a cluster warhead — a dispersal warhead designed to scatter smaller explosives across a wide area — along with a test of the missile’s ability to strike targets vertically from above.

According to the state-run Korean Central News Agency, the tests were conducted on 2 November by the Missile Administration, under the direction of General Kim Jong-sik, a member of the ruling party’s Central Military Commission. The agency quoted the bureau as saying that a medium-sized dispersal warhead mounted on a cruise missile was “capable of turning a target area of five to six hectares into ashes”. North Korean leader Kim Jong Un was not reported to have attended.

The cruise missile test followed a similar trial on 31 October, in which North Korea tested a cluster warhead for a tactical ballistic missile and claimed it could devastate an area of 12 to 13 hectares. The Missile Administration said after that launch that frontline units would be able to use four types of cluster warheads by the end of the year. The two tests came only days after North Korea fired around ten short-range ballistic missiles from Wonsan on 29 October, its 17th ballistic missile launch of the year, according to reports.

North Korea’s claims about the warheads’ destructive power and the missiles’ capabilities have not been independently verified, and South Korean and United States officials were still conducting a detailed analysis when the tests were announced. The missiles used in the cruise missile test were not identified, although analysts have suggested they belonged to the Hwasal family of cruise missiles. Cluster munitions scatter many small submunitions that can fail to explode and leave deadly remnants for civilians, which is why the weapon type is widely condemned internationally.

The timing is coincidental — the leak and the missile tests are separate events — but together they sketch a picture of a peninsula in which Seoul’s security machinery is being tested from both inside and outside. A government that cannot keep its own president’s passport details off a public website will face sharper questions about its ability to track a neighbour that is steadily expanding the range and lethality of its arsenal.

South Korea has also had a difficult year for data security more broadly. In October, Lee told a cabinet meeting that artificial intelligence models appeared to have been used in a series of hacks against South Korean banks, and police launched a full-scale probe after several banks reported breaches affecting tens of thousands of customers. The presidential leak is a different kind of incident — a leak rather than a hack, according to the foreign ministry — but it lands in a public debate about data protection that the president himself has helped to set.

Analysis: Why It Matters

The five months are the scandal

Data leaks happen; what makes this one damaging is the duration. A file uploaded on 2 June and still sitting on a paid platform in early November means that for almost five months, anyone with a subscription could have downloaded the passport numbers, birth dates and job titles of the president, his wife, his ministers and the people who guard him. The government says it has no evidence the information spread further, but absence of evidence is not evidence of absence — and a file that sat in the open for five months cannot be un-seen. The question the investigation must answer is not only who uploaded it, but why no one in the presidential office or the foreign ministry noticed for five months that a classified passenger list was sitting on a public website.

The bodyguards matter more than the president

A president’s name, face and movements are public by definition. The genuinely sensitive material in this file is the identities of the people around him: the security planning officials, the escort personnel, the medical staff and the food taster. Those are the people whose anonymity is part of the president’s protection. Passport numbers and dates of birth are useful for identity theft, but names, roles and photographs of a protection detail are useful for something worse — for mapping who stands between a president and an attacker. That is why the opposition’s sharpest line is not about Lee’s own passport but about the exposure of his security staff, and it is the line the government will find hardest to answer.

A security tool became the vulnerability

The most instructive detail in this story is also the most mundane: the file was probably uploaded to the malware-scanning site as part of a security check. Someone, trying to do the careful thing — verifying that a document was safe before it travelled with the president — uploaded it to a service whose business model is to make uploaded files available to its subscribers. It is a textbook example of how security hygiene can defeat itself when the tools are not understood. Governments around the world use commercial scanning services every day; the lesson of this leak is that any file containing personal data should never be uploaded to a service that shares it, however reputable the service. The fix is procedural and cheap — a rule, a training session, a ban on uploading classified lists to external platforms — which makes the failure to have it in place all the more striking.

Lee’s own rhetoric is now the standard he is judged by

Presidents are rarely damaged by a single incident; they are damaged when an incident confirms a story their opponents are already telling. Lee built his presidency on the promise of discipline and accountability after the chaos of the martial law crisis, and he has spoken publicly about penalties for data breaches so severe that companies would fear being put out of business. The opposition leader’s jibe — “It is now the presidential office’s turn to go down?” — is effective precisely because it uses Lee’s own standard. The ruling party’s response, that the opposition should wait for the investigation, is reasonable but defensive, and it concedes the frame: the government is now the subject of the kind of scrutiny it has applied to others.

A test of the machinery, not just the men

The leak also matters because of what it reveals about the machinery of the South Korean state. The foreign ministry manages the presidential aircraft’s passenger lists; the presidential office sets security protocols for trips; the Personal Information Protection Commission regulates data handling; the police investigate. All four are now involved, and all four will have to explain how a classified list travelled from a government computer to a public website without anyone noticing. If the answer is a single careless upload by a junior official, the fix is simple. If the answer is that no one was responsible for checking, the problem is structural — and the same structural gap could apply to far more sensitive material than a passenger list. The investigation’s findings will matter less for the fate of any individual official than for what they say about whether the system around the president actually works.

What to Watch Next

1. The police investigation: Police moved from a preliminary inquiry to a formal investigation within a day. The key findings will be who uploaded the file, whether it was an internal leak or a careless upload, and whether anyone else had access to it during the five months it was online.
2. The data regulator’s verdict: The Personal Information Protection Commission has received the foreign ministry’s report and said it will verify the facts. Its findings — and any penalties or corrective orders — will set the official account of what went wrong.
3. The passport reissue: All 168 people, including the president and first lady, are having their passports reissued. Watch for any reports from those affected of attempted identity theft or fraud, which would show whether the exposed data was actually used.
4. Heads and protocols: The Blue House has ordered a comprehensive review of security management for presidential trips. Whether any official is disciplined — and what new rules emerge — will show how seriously the presidency takes its own failure.
5. The North Korean angle: Pyongyang says its forces will be able to use four types of cluster warheads by the end of the year, and South Korean and US officials are still analysing the latest tests. Any further launches or claims in the coming weeks will keep the peninsula’s security debate at the top of the agenda in Seoul.

Sources

• Reuters, via BusinessWorld — “South Korea investigates leak of President Lee’s passport details”, 3 November 2026
• Korea JoongAng Daily — “PPP calls leak of President Lee Jae Myung’s personal data a security disaster”, 3 November 2026
• Aju Press — “Police Launch Formal Investigation into Personal Data Leak Involving President Lee’s Flight”, 3 November 2026
• Seoul Economic Daily — “Leak of Presidential Delegation List Prompts 168 Passport Reissues”, 3 November 2026
• Aju Press — “North Korea conducts ‘major’ weapons tests”, 3 November 2026