Most gov't agencies deny using VirusTotal, deepening questions over presidential data leak

Most government agencies said they do not use VirusTotal, where personal information belonging to 168 people on President Lee Jae Myung’s June trip to Europe was exposed for about five months. The foreign ministry is investigating an employee after detecting unusual behavior, while an outside security contractor is also under suspicion. The government suspects at least one official may have leaked the information through poor judgment rather than malice, but the investigation is ongoing.

VirusTotal scans uploaded files and URLs with more than 70 antivirus engines and security tools, and files submitted through its public interface are shared with participating security vendors and may be accessible through enterprise datasets.

The exposed group included President Lee and the first lady, senior officials, security personnel and reporters traveling with the presidential delegation.

The Ministry of National Defense did not confirm whether it uses VirusTotal and said military security operates separately from civilian agencies.

The Korea Disease Control and Prevention Agency said it does not use VirusTotal but cannot determine whether individual employees use it privately because its activity monitoring does not cover every action.

The government reportedly found signs that the delegation file passed through an outside contractor that monitors the foreign ministry’s internal systems and handles malware analysis for its cybersecurity center.

Published Nov 5, 2026 2:31 pm KST

Updated Nov 5, 2026 2:37 pm KST

President Lee Jae Myung and first lady Kim Hea Kyung step off Korea’s presidential aircraft at Seoul Air Base in Seongnam, Gyeonggi Province, June 18. Korea Times photo by Wang Tae-seog

Most government agencies told The Korea Times they do not use VirusTotal, the malware analysis platform where the personal information of the first couple was exposed for about five months, deepening questions over how the leak occurred.

The paid platform had hosted sensitive personal information of 168 people aboard the presidential jet during President Lee Jae Myung’s trip to Europe in June.

Those affected included not only the president and first lady but also high-ranking officials, including then-chief of staff for policy Kim Yong-beom, National Security Adviser Wi Sung-lac, current Prime Minister Han Seong-sook and several Cabinet members, as well as senior officials from Cheong Wa Dae and the Ministry of Foreign Affairs, security personnel and reporters traveling with the presidential delegation.

VirusTotal, a web service owned by Google, scans uploaded files and URLs simultaneously using more than 70 antivirus engines and security tools. Files submitted through its public interface are shared with participating security vendors and can be accessed by organizations that subscribe to VirusTotal’s enterprise datasets — meaning a document uploaded for a routine malware check can become available to outside parties.

[COVER STORY] President, first lady to get new passports after personal data exposure

An official from the foreign ministry, under which an employee is suspected in the leak, said they had never heard of staff frequently using the platform.

“I first heard of it after this incident broke,” the official said, adding that the investigation is still ongoing.

Cheong Wa Dae, whose senior officials were among those exposed, gave no clear answer on whether it uses VirusTotal.

The Ministry of National Defense also did not confirm whether it uses the platform, adding that its security cannot be judged by the use of any single program because the military runs a security system separate from that of civilian agencies.

The Korea Disease Control and Prevention Agency said it does not use VirusTotal. But the agency added that it cannot know for certain whether individual staff use the platform privately because its monitoring of employee activity records does not cover every single action.

The Ministry of Trade, Industry and Energy, the Ministry of Science and ICT, the Fair Trade Commission, the National Human Rights Commission of Korea, the Ministry of Health and Welfare, the Ministry of Employment and Labor and the Ministry of Education also said they do not use the platform.

VirusTotal itself has yet to respond to questions from The Korea Times, including whether it bears any responsibility for the leak and how it keeps sensitive information off its platform.

While agencies distance themselves from the platform, several possibilities have been raised over where the leak originated.

The foreign ministry is reportedly investigating an employee after detecting unusual behavior, with the government suspecting that at least one official leaked the information out of poor judgment rather than malice.

Suspicion has also fallen on an outside contractor handling security for the foreign ministry. The government has reportedly found signs that the leaked delegation file passed through the contractor, which monitors the foreign ministry’s internal systems.

The firm, which also handles malware analysis for the ministry’s cybersecurity center, may have uploaded the file to VirusTotal. Korean media reported that separate diplomacy-related documents had also been uploaded to VirusTotal.

大多数政府机构表示未使用VirusTotal，此前，李在明总统6月访欧期间168人的个人信息曾被泄露，并持续约五个月之久。外交部在发现一名员工行为异常后正在对其展开调查，同时，一家外部安保承包商也受到怀疑。政府怀疑至少有一名官员可能出于判断失误而非恶意泄露了信息，但调查仍在进行中。

VirusTotal 使用 70 多种防病毒引擎和安全工具扫描上传的文件和 URL，通过其公共界面提交的文件会与参与的安全厂商共享，并且可能通过企业数据集访问。

被曝光的人员包括李总统和第一夫人、高级官员、安保人员以及随总统代表团出差的记者。

国防部没有证实是否使用 VirusTotal，并表示军事安全部门与民事机构独立运作。

韩国疾病管理厅表示，他们不使用 VirusTotal，但无法确定个别员工是否私下使用该软件，因为其活动监控无法涵盖所有​​行为。

据报道，政府发现有迹象表明，代表团文件曾经过一家外部承包商，该承包商负责监控外交部的内部系统，并为其网络安全中心处理恶意软件分析。

发布于2026年11月5日下午2:31（韩国标准时间）

更新于2026年11月5日下午2:37（韩国标准时间）

6月18日，韩国总统李在明和夫人金喜京走下总统专机，抵达京畿道城南市首尔空军基地。（韩国时报 王泰锡 摄）

大多数政府机构告诉《韩国时报》，他们不使用 VirusTotal 这个恶意软件分析平台。第一夫妇的个人信息曾被泄露约五个月，这加深了人们对泄露事件如何发生的疑问。

该付费平台在李在明总统6月访问欧洲期间，托管了总统专机上168人的敏感个人信息。

受影响的不仅包括总统和第一夫人，还包括高级官员，如当时的政策办公室主任金容范、国家安全顾问魏成乐、现任总理韩成淑和几位内阁成员，以及青瓦台和外交部的高级官员、安保人员和随总统代表团出访的记者。

VirusTotal 是谷歌旗下的一项网络服务，它使用超过 70 种杀毒引擎和安全工具同时扫描上传的文件和 URL。通过其公共界面提交的文件会与参与的安全厂商共享，并且订阅了 VirusTotal 企业数据集的组织可以访问这些文件——这意味着，原本用于例行恶意软件检查的文档也可能被外部人员获取。

【封面报道】总统和第一夫人个人数据泄露后将更换护照

外交部一名官员表示，他们从未听说过有工作人员频繁使用该平台，而泄密事件的嫌疑人正是该部门的一名员工。

“我是在这起事件曝光后才第一次听说这件事的，”该官员表示，并补充说调查仍在进行中。

青瓦台的高级官员也曾受到病毒感染，但青瓦台并未明确表示是否使用 VirusTotal 服务。

国防部也未证实是否使用该平台，并补充说，不能仅凭使用任何单一程序来判断其安全性，因为军方运行的安全系统与民用机构的安全系统是分开的。

韩国疾病管理厅表示，他们不使用VirusTotal平台。但该机构补充说，由于其对员工活动记录的监控无法涵盖所有​​操作，因此无法确定个别员工是否私下使用该平台。

韩国产业通商资源部、科学技术信息通信部、公平交易委员会、国家人权委员会、保健福祉部、雇佣劳动部和教育部也表示他们不使用该平台。

VirusTotal 本身尚未回应《韩国时报》提出的问题，包括它是否对此次泄露事件负有任何责任，以及如何防止敏感信息在其平台上泄露。

尽管各机构都试图与该平台撇清关系，但关于泄露源头，人们提出了几种可能性。

据报道，外交部正在调查一名雇员，此前该雇员被发现有异常行为。政府怀疑至少有一名官员泄露信息是出于判断失误，而不是恶意。

怀疑对象还包括一家负责外交部安保工作的外部承包商。据报道，政府已发现迹象表明，泄露的代表团文件曾经由这家承包商之手，而该承包商负责监控外交部的内部系统。

这家公司也为韩国国防部网络安全中心提供恶意软件分析服务，可能已将该文件上传至 VirusTotal。韩国媒体报道称，另有一些与外交相关的文档也被上传至 VirusTotal。