SEOUL — While hacking and data leaks continue to plague South Korea's financial sector, public institutions, and universities, fresh scrutiny has fallen on the Ministry of Food and Drug Safety (MFDS) over glaring security loopholes in its management of clinical trial data.

During a parliamentary audit, it was revealed that 2,672 clinical trial documents—which the ministry has officially kept under wraps—could be downloaded effortlessly using the generative AI chatbot ChatGPT, bypassing any login or password requirements. This revelation has once again cast a shadow over the government's overall information security management system.

2,672 Clinical Trial Documents Downloaded via ChatGPT

On October 13, during the National Assembly Health and Welfare Committee's audit, People Power Party lawmaker Lee So-hee disclosed that she managed to download 2,672 clinical trial result documents using only ChatGPT, without entering a single login credential or password.

Lawmaker Lee noted that the downloads required no advanced technical knowledge. Among the leaked files, 839 contained corporate information designated as confidential, while 2,208 included the personal mobile phone numbers of responsible personnel.

The website in question is the "Drug Safety Nara" portal, a comprehensive repository of pharmaceutical data. The platform consolidates extensive information on clinical trials, drug genetics, pharmaceuticals, cosmetics, domestic and international drug patents, biopharmaceuticals, and drug additives.

If personal and confidential data could indeed be downloaded using only ChatGPT as Lee pointed out, the possibility that sensitive information was already exposed beforehand cannot be ruled out.

"The ministry kept its doors locked to the National Assembly under the pretext of protecting corporate secrets, yet it carelessly allowed external actors to walk away with files," Lee remarked, adding that she has demanded the immediate disposal of the data downloaded by the MFDS.

The crux of the controversy is that clinical trial result documents—which the ministry withheld from lawmakers—were freely downloadable from the outside without authentication. However, the exact mechanism by which ChatGPT accessed these files or the specific vulnerabilities in the access controls of "Drug Safety Nara" have not yet been officially confirmed.

Following Financial Sector, MFDS Faces Information Security Backlash

Recent security breaches in South Korea have spread from the financial sector to public corporations, universities, and large religious organizations. The leaked data ranges from bank customer credit records and public enterprise contact lists to university student records and church congregation directories. Clinical trial results, in particular, are considered highly critical assets as they often harbor closely guarded corporate secrets.

Industry experts point out a key distinction in this case: rather than a conventional external cyberattack, the issue stems from a failure to enforce mandatory authentication procedures for restricted documents. It remains unconfirmed whether third parties actually viewed or downloaded the data.

"If information is truly sensitive, downloads should only be permitted after rigorous authentication processes," an IT industry insider said. "If internal ministry data can be searched and viewed by anyone, sensitive information may have already leaked."

"Given that the ministry even mentioned disposing of the files, they likely contained highly sensitive material," the insider added. "This parliamentary audit will make it difficult for the government to deflect criticism regarding structural flaws in its security oversight."

[Copyright (c) Global Economic Times. All Rights Reserved.]