South Korea's Ministry of Foreign Affairs has reported a personal data breach involving passengers on the presidential aircraft to the Personal Information Protection Commission (PIPC), the national privacy regulator. MoneyToday reports that the ministry filed the report on the morning of 3 November 2026. The day before, media reports had revealed that an Excel file with the names, dates of birth and passport numbers of 168 people on a presidential flight had been posted on a paid website. According to MoneyToday, the list includes President Lee Jae Myung and First Lady Kim Hye Kyung. The ministry has confirmed the breach and says police are helping it investigate. It has not said how the file got out, and no one has claimed responsibility.
What Happened
MoneyToday, citing the PIPC, reports this sequence of events:
- 2 November: An Excel file listing the passengers on the presidential aircraft appeared on a paid website. Media reports about it followed.
- 3 November, morning: The Foreign Ministry formally reported the breach to the PIPC.
- 3 November, briefing: The ministry said that "as soon as we confirmed the breach in advance, we requested investigation and inquiry from relevant agencies." It added that it is "conducting an investigation to identify the cause of the leakage with the cooperation of relevant agencies, including the National Police Agency."
Under the Personal Information Protection Act, the PIPC can check the facts and open its own investigation once it receives a breach report or suspects the law has been broken. The regulator says it will check the facts first. It has not announced a formal investigation.
Several key details are still not public:
- Which trip. It is not clear which trip the list covers. MoneyToday describes Kim Yong-beom as "then Policy Chief", which suggests the list may be from an earlier overseas visit rather than a recent one.
- The website. The site where the file was posted has not been named.
- Hack or not. Neither the ministry nor the PIPC has said whether this was a network intrusion, an insider leak, a mistake in handling the file, or a breach at a contractor such as a travel or logistics provider.
What Was Taken
MoneyToday reports the following about the file:
- Size: One Excel spreadsheet covering 168 passengers. MoneyToday is the only outlet so far to give this figure. Neither the ministry nor the PIPC has publicly confirmed it.
- Data fields: Full names, dates of birth and passport numbers.
- People named: President Lee Jae Myung and First Lady Kim Hye Kyung; minister-level officials from the Ministry of Science and ICT and the Foreign Ministry; National Security Office Director Wi Seong-hak; Kim Yong-beom, then Policy Chief; working staff from the Presidential Secretariat; and accredited reporters who travelled with the delegation.
The record count is small, but this is a very sensitive set of data. Passport numbers combined with dates of birth can be used to impersonate people, to forge travel documents, and to make targeted phishing messages more convincing. The file also shows who travels with the president: the national security office, senior policy staff and the press pool. That is useful information for any foreign intelligence service.
Why It Matters
Full list of people around the president. A flight manifest shows who is in the president's inner circle and how a delegation is organised. Anyone planning targeted phishing against senior officials, their aides or the journalists who cover them now has a verified list of names with identity details attached.
Sold, not just leaked. The file turned up on a paid website rather than an open leak forum. That suggests someone is trying to make money from it, or that it has already passed through more than one pair of hands.
A heavy run of Korean breaches. This leak comes during a very busy period:
- Financial sector. The Financial Services Commission said on 14 October that 16 financial companies had confirmed breaches, with an estimated 100,000 customer records exposed. DW reported in early October that seven major institutions had been hit at that point, and that Korea Electric Power Corp. and two large churches had also confirmed unauthorised access.
- AI-assisted attacks. CrowdStrike linked part of the bank activity to an unnamed, financially motivated attacker who is likely a Chinese speaker. CrowdStrike says the attacker used ARTEX, an open-source AI pentesting tool, together with large language models. Prime Minister Han Seong-sook warned, as quoted by Yonhap and DW, that similar methods could spread to "government and public sectors".
- Lazarus. Kaspersky's Securelist separately documented Operation FlashHole, a North Korean Lazarus Group campaign against Korean software, construction and telecoms equipment makers. It abused mandatory Korean security software and used watering-hole sites.
- Suppliers. Several recent cases came through third parties. JoongAng Daily reports that a breach at the training provider Malgnsoft exposed data from more than 20 client organisations, including the Ministry of National Defense and the Anti-corruption & Civil Rights Commission. The Asia Business Daily reports that a backup-server breach at Douzone Bizon exposed The Born Korea's employee and partner data. The Korea Herald reports that the PowerSchool breach is still affecting about 15,666 records at three Seoul international schools.
There is no confirmed link between the presidential flight leak and any of these campaigns. They show how active attackers are in Korea at the moment. They do not show who leaked this file.
The Attack Technique
The method is unknown. The Foreign Ministry has not said how the file left its control, and the PIPC is still checking the facts. No technical indicators have been released. No group has claimed the leak, and no security vendor has linked it to any known actor.
The realistic possibilities are:
- A contractor breach. Recent Korean cases at Malgnsoft and Douzone Bizon show suppliers are a common weak point. Passenger lists are often shared with airlines, ground handlers, travel agents and the governments being visited.
- An insider or handling failure. The file may have been leaked by someone with access, or exposed through a careless step such as emailing it, saving it to a shared drive or sending it through a messaging app.
- A direct intrusion into government systems.
Until the ministry or police say more, readers should not treat any of these as confirmed.
What Organizations Should Do
- Treat VIP travel lists as classified-grade data. Keep manifests, passport scans and itineraries in access-controlled systems with logging. Do not pass them around as Excel attachments. Delete or archive them once the trip is over.
- Track every copy you send out. Keep a record of each outside party that gets a passenger list, including airlines, handlers, host governments and travel agencies. Include data-handling and breach-notification terms in the contract.
- Watch paid leak and broker sites. Monitor for your organisation's documents and staff identity details. In this case the file was found through media reports, not internal detection.
- Warn the people named. Tell officials, staff and journalists on exposed lists to expect targeted phishing and identity fraud. Where passport numbers are exposed, set up a way for them to get passports reissued.
- Check your suppliers now. Given the Malgnsoft, Douzone Bizon and PowerSchool cases, review which outside providers hold your staff's personal data. Confirm their backup servers and training systems are patched, and confirm they are required to report incidents to you quickly.
- Block the indicators already published. Apply the IP addresses the Financial Services Commission has shared, along with the indicators CrowdStrike and Securelist have published for the ARTEX and Lazarus FlashHole activity. Watch for AI-assisted scanning and exploitation of public web applications.
Sources: Exclusive Foreign Ministry reports data leak involving presidential... | Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Fi... | Dissecting Operation FlashHole, a complex attack by Lazarus Secure... | S. Korea warns of AI-aided hacking after bank data breaches | Data on 16,000 people compromised at 3 Seoul international schools... | Kia data breach exposes personal information of 5,000 union members | "Unauthorized access to outsourced vendor's server"... The Born Kor... | Press Releases - Financial Services Commission