Google Cloud says it deleted leaked presidential info at Korean gov't request
A person takes a photo of the Google Cloud logo during 2025 MWC Barcelona in Spain, March 4, 2025. Reuters-Yonhap
Firm highlights VirusTotal safeguards, gives no answer on responsibility
Google Cloud told The Korea Times that it deleted the Korean first couple’s personal information, exposed for about five months on its VirusTotal platform, immediately after Korean authorities requested its cooperation.
The response follows a finding that the malware analysis platform, owned by Google Cloud, had hosted sensitive personal information of 168 people aboard the presidential jet during President Lee Jae Myung’s trip to Europe in June.
"Google Cloud removed the relevant data from VirusTotal immediately after confirming government authorities' request," the company said in a statement sent to The Korea Times on Friday.
VirusTotal scans uploaded files and URLs simultaneously using more than 70 antivirus engines and security tools. Files submitted through its public interface are shared with participating security vendors and can be accessed by organizations that subscribe to VirusTotal’s enterprise datasets — meaning a document uploaded for a routine malware check can become available to outside parties.
It was found through a media report on Monday that a file containing the sensitive information of the 168 people, including the first couple and top government officials, had been uploaded to the website since June. The foreign ministry, which is in charge of presidential trips, has not disclosed when it discovered the fact, how and why the information had been uploaded on VirusTotal and whether it was by a ministry official or an outside agency handling the trip, only reiterating that an investigation is ongoing.
Google Cloud and its public relations agency in Korea did not respond to questions about whether VirusTotal bears any responsibility for the leak and how many times the file was viewed. They also did not disclose exactly which government authorities requested the removal.
“Attackers often create 'lure documents' disguised as legitimate ones to trick victims into installing malware. VirusTotal acts as an early warning system against such threats, giving security teams real-time visibility to catch these traps before users click on them,” the agency said.
It added that VirusTotal plays that role through a crowdsourcing sharing model, continuously strengthening global defenses by sharing user-submitted files with the public community and security vendors.
For enterprise users, the agency said VirusTotal strongly recommends they use its Private Scanning function, which allows them to analyze files and URLs in a privacy-preserving fashion, to prevent sensitive or confidential data from being accidentally shared outside their organizations.