[Exclusive] "Selling COVID-19 Lists"... 2 Million Personal Data Records Circulated

'Corona List' Secretly Traded

Names, Phone Numbers, Addresses, and Temperatures Included
DB Dealers Claim "Hacked Government Data"
Low Possibility of Actual Entry List Leakage
Even if False, Clear Crime... Investigation Needed

Photo by Getty Images Bank

[Asia Economy Special Investigation Team] Millions of pieces of personal information, referred to as leaked copies of entry logs created to prevent the spread of the novel coronavirus infection (COVID-19), are being sold on Telegram.

On the 19th, Asia Economy obtained from a dealer on Telegram the so-called 'COVID list,' which contained personal information of a total of 12,000 people densely recorded. This data included names, phone numbers, residences, measured body temperatures, and seemingly encrypted meaningless numbers. The names of specific establishments were not listed. Except for the recorded body temperatures, it appeared to be close to what is called 'Makdibi' (a database containing only simple personal information such as names and phone numbers). The dealer said they had about 2 million more such databases.

The dealers contacted by the investigation team explained that these databases are mainly sought by those who want to conduct telemarketing or send spam messages to unspecified many people. Databases with clear purposes such as 'Daebuyongdibi' and 'Mamkaepedibi' are somewhat expensive, priced at over 100 won per case, but the COVID list database is cheap at 10 to 20 won per case. Despite being priced similarly to Makdibi, the COVID list has a higher information match rate, so recently more people have been looking for this data, they explained.

When randomly selecting about 30 people listed in the actual list and verifying by phone, most names and phone numbers matched. However, there were cases where the residence did not match. They said they had no idea why their personal information was circulating under the name of the COVID list.

The 'Corona List' obtained from a database sales agent. This data, organized in an Excel file, included names, phone numbers, residential areas, and body temperatures.

Sellers claim that they produced this data based on entry logs secretly stolen by hacking government agencies. They said they hacked the lists that the Ministry of Health and Welfare, the Korea Disease Control and Prevention Agency, and local governments collected from establishments for confirming confirmed cases and contacts and converted into databases.

However, the Ministry of Health and Welfare and the Korea Disease Control and Prevention Agency stated that there was no hacking or external access. Personal information obtained through QR code scans is separately stored by the Korea Social Security Information Service, a quasi-governmental agency under the Ministry of Health and Welfare, and QR code service companies, and is only used when necessary, so there is no case of creating and storing data in the form of the currently circulating COVID list. In the case of handwritten logs, they are managed by the Korea Electronics Technology Institute, making hacking itself impossible.

Summarizing both sides' claims, it is suspected that the data was distributed under the name 'COVID list' by adding COVID-related information to already leaked personal information. However, as concerns about personal information leakage were high when handwritten logs were created at cafes and restaurants due to the nationwide spread of COVID-19, verifying the authenticity of the data as a COVID list is inevitable. If the data was actually made based on entry logs, public trust in quarantine policies could decline. A police official said, "Falsely labeling and distributing data under the name of the COVID list can be considered an act that causes confusion in quarantine," adding, "If there is suspicion, investigation may also be possible."

This content was produced with the assistance of AI translation services.