A passenger list available before departure
The information appeared in an Excel file titled "Passenger list (Republic of Korea-Belgium)" on a platform offering malware scans for files and web addresses. Paying users could download the spreadsheet, according to KBS reporting cited by Chosun Biz.
The file was uploaded on June 2, 2026, a week before Lee's June 9 departure for Europe, and remained accessible for roughly five months, according to KBS findings reported by Yonhap and Chosun Biz.
The spreadsheet is believed to be the passenger manifest for the presidential aircraft during Lee's June visit to Belgium, Italy and France. That trip included attendance at the Group of Seven (G7) summit, Yonhap and Chosun Biz reported.
KBS said the exposed records included passport numbers, birth dates and passport validity information. Those affected included presidential office and foreign ministry staff, security advisers, bodyguards, Lee's personal physician and journalists covering the presidential office.
Chosun Biz, citing KBS, identified First Lady Kim Hea-kyung, National Security Adviser Wi Sung-lac and former presidential policy chief Kim Yong-beom among those whose data appeared in the file. The affected presidential office staff worked at Cheong Wa Dae.
Presidential office and ministry respond
The presidential office announced a review of the leak and immediate countermeasures. In a response reported by Yonhap, it also said it had learned of the report's contents before publication and had already taken measures.
A foreign ministry official told Yonhap that the ministry was investigating the circumstances in depth and would decide what further action was needed based on its findings.
Earlier attacks on financial institutions
Despite South Korea's reputation as one of the world's most technologically advanced and connected countries, it has repeatedly faced criticism over cybersecurity weaknesses and failures to protect personal information.
The presidential data exposure follows a broader series of breaches. In late September and early October 2026, Lee ordered a thorough investigation after cyberattacks involving financial institutions, including Shinhan Bank, KB Kookmin Bank, Hana Bank and Woori Bank, according to Reuters reporting published by The Asahi Shimbun on October 5.
The Financial Services Commission said it could not rule out the possibility that artificial intelligence had been used in those attacks, Reuters reported.
