Most gov't agencies deny using VirusTotal, deepening questions over presidential data leak

The exposed file contained personal information about 168 people who traveled on President Lee Jae Myung’s Europe trip. The group included the president, the first lady, officials, security personnel and reporters. The exposure matters because the information concerned a presidential delegation and remained available for about five months.

Agencies are being asked whether they used VirusTotal because its public interface shares submitted files with participating security vendors. Enterprise customers may also access those samples. A routine malware check could therefore make a sensitive government document available beyond the original agency.

Most agencies told The Korea Times that they do not use VirusTotal. The foreign ministry is investigating an employee after detecting unusual behavior, while an outside contractor is also under suspicion. Officials reportedly found signs that the file passed through that contractor, but the investigation has not established the full route.

VirusTotal is a web service owned by Google that checks uploaded files and URLs against more than 70 antivirus engines and security tools. Its purpose is to help identify malicious software. That makes it useful for security analysis, but the submission process carries an important privacy risk.

Files uploaded through the public interface are shared with participating security vendors. Organizations that subscribe to VirusTotal’s enterprise datasets may also access them. This means a document uploaded for a routine malware check may become available to outside parties, rather than remaining only with the organization that submitted it.

That mechanism is central to the presidential delegation leak. The article says a file containing sensitive personal information was hosted on the platform for about five months. VirusTotal had not responded to questions about responsibility for the leak or safeguards for sensitive information.

The scale was 168 people aboard the presidential jet during President Lee Jae Myung’s June trip to Europe. This was not a small internal contact list. It covered the president and first lady, senior officials, security personnel and reporters traveling with the delegation.

The information was exposed on VirusTotal for about five months. The platform’s public interface shares uploaded files with participating security vendors, and enterprise datasets can make them accessible to subscribing organizations. The danger therefore came from both the sensitivity of the file and the length of time it remained hosted.

The article does not specify every field contained in the file. It does establish that personal information belonging to the group was exposed. The foreign ministry’s investigation, along with scrutiny of an outside contractor, is intended to clarify how the file reached the service and remained there.

The exposed group included President Lee Jae Myung and the first lady. It also included then-chief of staff for policy Kim Yong-beom, National Security Adviser Wi Sung-lac, current Prime Minister Han Seong-sook, Cabinet members, senior Cheong Wa Dae and foreign ministry officials, security personnel and reporters.

Their information was especially sensitive because the group represented the presidential delegation traveling aboard the presidential jet. It combined the identities of top political officials with people responsible for security and journalists accompanying them. The article does not list every data field, but it confirms that personal information for all 168 people was exposed.

The exposure also affected people across several roles and institutions. That broadens the potential impact beyond one office. Investigators are examining the foreign ministry and an outside contractor to determine whether poor judgment, rather than malice, led at least one official to leak the information.

The reported route begins inside the foreign ministry, where an employee is under investigation after unusual behavior was detected. The government also suspects an outside contractor that monitors the ministry’s internal systems and handles malware analysis for its cybersecurity center.

According to the article, officials found signs that the leaked delegation file passed through this contractor. The contractor may then have uploaded the file to VirusTotal during malware analysis. The platform’s public interface shares submitted files with participating security vendors, creating the possible link between an internal document and outside access.

This route remains a possibility, not a confirmed final account. The government reportedly believes at least one official may have acted out of poor judgment rather than malice. The foreign ministry investigation is ongoing, and the contractor’s suspected role has not been resolved. Most agencies also deny using VirusTotal directly.

Submitting a sensitive document to a malware-scanning service can turn a private security check into a disclosure event. The service may retain the file and share it with outside security organizations. That matters because confidential information can be exposed even when the uploader’s goal was only to identify malware.

VirusTotal scans files with more than 70 antivirus engines and security tools. But files submitted through its public interface are shared with participating security vendors. Organizations subscribing to VirusTotal’s enterprise datasets may also access them. In this case, a delegation file containing personal information for 168 people was available for about five months.

The consequences can include loss of control over personal information and wider access to a government document. The article does not report specific misuse by outside parties. It does show why agencies are examining who uploaded the file, including an employee and an outside contractor, while VirusTotal has not answered questions.

The article does not identify specific alternatives to VirusTotal. In general, organizations handling confidential files can analyze them inside an isolated internal sandbox or with locally managed antivirus tools. These methods keep suspicious samples within controlled systems instead of sending them to a public submission service.

A safer workflow can also separate sensitive content from the malware question. Teams can remove personal information when possible, use harmless test copies, limit access, encrypt stored samples and document who may handle them. They should review a provider’s retention and sharing rules before uploading anything. Public services should not receive confidential files unless approved protections are confirmed.

These practices matter because VirusTotal’s public interface shares submitted files with participating vendors, and enterprise datasets may expose them to subscribing organizations. The reported leak shows the risk of poor judgment. Agencies should define approved tools, train staff and contractors, and monitor uploads while preserving necessary malware-analysis capabilities.