2,672 South Korean Clinical Trial Documents Exposed via ChatGPT Without Login — Corporate Secrets and Personal Data Leaked
An investigation has revealed that 2,672 clinical trial-related documents managed by South Korea's Ministry of Food and Drug Safety (MFDS) could be downloaded externally through ChatGPT without any separate login or password. The documents contained non-public corporate information and even the mobile phone numbers of responsible personnel, shaking confidence in the MFDS's overall data protection framework.
Rep. Lee So-hee of the People Power Party disclosed during the MFDS parliamentary audit at the National Assembly Health and Welfare Committee on the 13th that while her office was unable to find a single public document on the Drug Safety Korea results page, it was able to download 2,672 clinical trial result documents. She explained that no hacking or specialized infiltration techniques were involved — the widely accessible ChatGPT was used, and no login or password was required.
Among the documents obtained, 839 contained corporate information designated as non-public, and 2,208 contained the mobile phone numbers of responsible personnel. In effect, core corporate information and personal data that were not meant for public disclosure were left exposed to external access.
Rep. Lee pressed, "The National Assembly was told the door was locked because these were corporate secrets, yet external parties were left free to take the files. If this information is suitable for disclosure, why wasn't it shown to the public? If it shouldn't be disclosed, why wasn't access blocked?"
MFDS Commissioner Oh Yu-kyoung stated that the ministry became aware of the data leak the previous day. "We blocked access early this morning and are reviewing the matter comprehensively," she said. "I apologize for the shortcomings."
Corporate Secret Standards and the Genencell Disclosure Demand
The issue has also escalated into a controversy over how the MFDS's "corporate secret" protection standards have actually operated in practice. Article 88 of the Pharmaceutical Affairs Act stipulates that drug information should in principle be kept confidential, but may be disclosed when necessary for the public interest. However, it has emerged that the MFDS has effectively not applied this provision since 2016.
Rep. Lee specifically questioned whether the MFDS had actually conducted a review weighing public interest against private interest regarding the disclosure of Genencell-related materials. When asked whether actual review documents existed, Commissioner Oh responded, "No such documents exist." Rep. Lee referenced court rulings on Genencell's founder and the clinical trial approval process, emphasizing, "This is about verifying how the ministry reviewed and on what grounds it approved a case where the allegation of obtaining clinical trial approval through false and omitted data was found guilty."
During the audit, when Rep. Lee asked, "May we disclose the materials we have obtained?" Commissioner Oh replied, "I believe you should destroy them." Rep. Lee demanded that the MFDS report in writing on whether external access to non-public clinical data has been blocked, the exact time of initial awareness and blocking, and the circumstances of media contact; preserve relevant records and conduct a full investigation of external downloads; and submit the Genencell public-interest disclosure review and approval documents, as well as review materials with trade secrets redacted.
Industry Repercussions and Future Challenges
This exposure incident could lead to trust issues regarding clinical trial data management for pharmaceutical and biotech companies. Clinical trial result documents often contain core new drug development data, trial designs, and safety information, and if leaked to competitors or foreign institutions, could directly impact corporate value.
The MFDS stated that it is conducting a comprehensive review of its data management system, including the circumstances that enabled external access and whether additional information was exposed. However, given that tracking the distribution channels of already-downloaded documents or recovering them is practically difficult, observers point out that follow-up protective measures are needed for the affected companies and personnel.