Most gov't agencies deny using VirusTotal, deepening questions over presidential data leak
President Lee Jae Myung and first lady Kim Hea Kyung step off Korea’s presidential aircraft at Seoul Air Base in Seongnam, Gyeonggi Province, June 18. Korea Times photo by Wang Tae-seog
Most government agencies told The Korea Times they do not use VirusTotal, the malware analysis platform where the personal information of the first couple was exposed for about five months, deepening questions over how the leak occurred.
The paid platform had hosted sensitive personal information of 168 people aboard the presidential jet during President Lee Jae Myung’s trip to Europe in June.
Those affected included not only the president and first lady but also high-ranking officials, including then-chief of staff for policy Kim Yong-beom, National Security Adviser Wi Sung-lac, current Prime Minister Han Seong-sook and several Cabinet members, as well as senior officials from Cheong Wa Dae and the Ministry of Foreign Affairs, security personnel and reporters traveling with the presidential delegation.
VirusTotal, a web service owned by Google, scans uploaded files and URLs simultaneously using more than 70 antivirus engines and security tools. Files submitted through its public interface are shared with participating security vendors and can be accessed by organizations that subscribe to VirusTotal’s enterprise datasets — meaning a document uploaded for a routine malware check can become available to outside parties.
An official from the foreign ministry, under which an employee is suspected in the leak, said they had never heard of staff frequently using the platform.
“I first heard of it after this incident broke,” the official said, adding that the investigation is still ongoing.
Cheong Wa Dae, whose senior officials were among those exposed, gave no clear answer on whether it uses VirusTotal.
The Ministry of National Defense also did not confirm whether it uses the platform, adding that its security cannot be judged by the use of any single program because the military runs a security system separate from that of civilian agencies.
The Korea Disease Control and Prevention Agency said it does not use VirusTotal. But the agency added that it cannot know for certain whether individual staff use the platform privately because its monitoring of employee activity records does not cover every single action.
The Ministry of Trade, Industry and Energy, the Ministry of Science and ICT, the Fair Trade Commission, the National Human Rights Commission of Korea, the Ministry of Health and Welfare, the Ministry of Employment and Labor and the Ministry of Education also said they do not use the platform.
VirusTotal itself has yet to respond to questions from The Korea Times, including whether it bears any responsibility for the leak and how it keeps sensitive information off its platform.
While agencies distance themselves from the platform, several possibilities have been raised over where the leak originated.
The foreign ministry is reportedly investigating an employee after detecting unusual behavior, with the government suspecting that at least one official leaked the information out of poor judgment rather than malice.
Suspicion has also fallen on an outside contractor handling security for the foreign ministry. The government has reportedly found signs that the leaked delegation file passed through the contractor, which monitors the foreign ministry’s internal systems.
The firm, which also handles malware analysis for the ministry’s cybersecurity center, may have uploaded the file to VirusTotal. Korean media reported that separate diplomacy-related documents had also been uploaded to VirusTotal.