AI Access to 2,672 Restricted Clinical Trial Files Puts South Korean Drug Regulator Under Scrutiny

Restricted Files Were Accessible Without a Login

South Korea's Ministry of Food and Drug Safety faces scrutiny after lawmaker Lee Sohee said her office downloaded 2,672 clinical trial documents from the regulator's drug information system using a publicly available generative artificial intelligence service, without logging in, entering a password or penetrating a server.

The figures presented at the National Assembly Health and Welfare Committee's October 13, 2026 audit show two distinct risks. Of the documents obtained, 839 contained company information designated as confidential, while 2,208 contained the mobile phone numbers of staff responsible for the submissions. Other information included names, email addresses, evaluation results and the groups of participants included in clinical trial analyses.

Lee, a People Power Party member of the committee, said the documents came from submissions by pharmaceutical companies, hospitals, universities and research institutions. Information appeared concealed on the public website, yet remained accessible in the underlying files.

The regulator said it was investigating the cause and whether the exposed information was actual clinical trial result data. Its commissioner, Oh Yoo-kyung, told the parliamentary audit that access had been blocked early that morning and that the agency was examining the wider system.

The central issue is the gap between a confidentiality decision and its technical enforcement. Lee's office said the agency had repeatedly refused parliamentary requests for clinical trial and approval records, including five requests from her office that year. Documents that could not be obtained through formal oversight channels were nevertheless retrievable externally.

The reported access route was not published. Disclosure followed notification to the regulator and its assurance that similar downloads had been stopped, leaving the investigation focused on the extent of exposure and the response rather than instructions for repeating it.

What the Document Counts Reveal

The 2,672 documents represent the collection obtained by Lee's office, not a confirmed count of every file that may have been accessible. No complete inventory of the affected system, or total number of downloads by other users, has been established publicly in the accounts of the audit.

The 2,208 documents containing mobile phone numbers account for approximately 82.6% of the collection. The 839 containing confidential company information represent approximately 31.4%. Those categories may overlap, so adding them together would not produce a valid count of separate affected documents.

These are document counts, not counts of people or companies. One person's contact details could appear in several files, and a single document could contain information about more than one person. The number of individuals whose details were exposed is therefore unknown.

The contents described by Lee's office went beyond contact information. Documents reportedly included findings about a medicine's effectiveness and serious adverse reactions. Evaluation results and information about analysis populations were also found in examined files. An analysis population is the group of trial participants whose data are included in a particular calculation, such as an assessment of effectiveness or safety.

Although the incident followed separate reports of patient and employee information being exposed at some national university hospitals, there is no established technical connection between those cases and this one. Nor has this incident been shown to involve identifiable trial participant records. The personal information specifically described here concerns staff and submission contacts.

What AI Did, and What Is Still Unknown

At the audit, Lee identified ChatGPT as the service used to obtain the files from the drug information platform known as Uiyakpum Safety Korea. Other descriptions referred more broadly to generative AI. Her account was that the downloads required neither authentication nor hacking.

Generative AI can help a user interact with information services, but its involvement does not establish that the system defeated a security control. The account instead points to files being retrievable despite their restricted status on the website. Hiding information in a page's visible presentation is different from preventing access to the document that contains it.

The precise technical failure has not been established. The regulator has not publicly identified whether the problem involved document permissions, the way files were delivered, or another part of the service. It would therefore be premature to describe a particular software flaw as the confirmed cause.

Lee's warning that foreign competitors or hacking groups could have obtained the material concerned the potential reach of the exposure. It was not evidence that either group actually downloaded it. Establishing who accessed the files requires examination of system records.

A Disputed Timeline of Notification and Blocking

The parliamentary exchange exposed a gap between when Lee said her office notified the agency and when its commissioner said she became aware of the incident. The sequence described at the October 13 audit was:

• October 11, 2026: Lee said her office alerted the regulator through a request for information, but received no substantive response.
• October 12: Oh said the agency became aware of the data exposure. She described a meeting that night and instructions to contact the lawmaker's office promptly.
• Early October 13: Oh said access permissions were blocked.
• October 13: Lee presented the document counts at the National Assembly audit and demanded a written account of the response.

The reports published on October 13 described disclosure as taking place after the regulator said it had stopped similar downloads. That sequence supports the agency's statement that a blocking measure preceded publication, but does not independently establish how complete the measure was.

The exact notification, recognition and blocking times were among the details Lee asked the agency to provide in writing before the audit ended. Those times matter because they would establish how long access continued after a warning reached the regulator and whether the warning was promptly passed to the people responsible for the system.

Parliamentary Access and the Public Interest Exception

The security incident also sharpened a dispute over the regulator's use of confidentiality rules. Lee said clinical trial, authorization and review documents had been withheld from the National Assembly over the preceding decade, with company objections among the reasons given for rejecting her office's five requests in 2026.

A more specific breakdown presented at the audit concerned a list of 96 disclosure cases over ten years. According to Lee, 95 remained confidential. The sole disclosed case was released at the company's request, not because the regulator independently decided disclosure was necessary in the public interest.

That distinction helps explain the difference between broad claims that no records had been disclosed and the count showing one release. The audit figures describe one disclosure in the listed cases, but no disclosure based on a public interest decision. They do not establish the status of every record held by the agency.

Lee argued that the Pharmaceutical Affairs Act permits disclosure where the public interest requires it, but that this exception had effectively gone unused. The dispute concerned records about adverse drug reactions and medical incidents, as well as vaccine and treatment authorization and review materials requested by lawmakers.

When asked whether an internal document existed recording the agency's comparison of commercial confidentiality and public interest in the disputed disclosure decision, Oh said there was no such document. That answer leaves the basis for the decision difficult to examine, although it does not by itself prove that no consideration occurred.

Why the Genencell Case Entered the Debate

Requests concerning Genencell were a particular focus of Lee's challenge to the regulator. The company's founder had reportedly received a four year prison sentence on appeal after convictions involving the submission of false information, or information missing key details, to obtain approval for a COVID treatment clinical trial.

Lee explicitly distinguished that conviction from a finding that the regulator's approval itself was improper. Her stated purpose was to examine how the agency reviewed the submissions, what additional information it required and what evidence supported its decision.

The regulator had refused the requested Genencell review materials on commercial confidentiality grounds, according to Lee. The contrast with the externally accessible documents made that refusal more contentious: the agency was defending restrictions on formal disclosure while facing evidence that its technical protections had not reliably enforced confidentiality.

The appellate conviction and the exposure investigation nevertheless address different questions. The conviction concerns conduct associated with a trial application. The security investigation concerns access to documents in the regulator's system. Neither establishes the answer to the other, and the precise relationship between the downloaded collection and the requested Genencell records was not specified.

The Agency's Response Came Under Scrutiny

Lee also challenged the regulator's communications after the problem was reported. She said agency officials repeatedly contacted a journalist to ask about the access method and sought a delay in publication, referring to possible harm to national interests, while failing to promptly establish the facts with her office.

The agency gave a different explanation of its purpose. Oh said the request was intended to prevent further exposure by ensuring that blocking measures were in place before the access issue became public. She accepted that the lawmaker's office should have been contacted promptly and apologized for an inadequate explanation.

Oh said the previous night's meeting had included instructions to visit the office quickly, even late at night, and that she understood the parliamentary liaison had visited several times. The precise sequence of those contacts remained part of the written account Lee requested.

Another exchange concerned what should happen to the downloaded material. Asked by Lee whether the files could be made public, Oh responded that they appeared to need disposal. Lee clarified that she was not proposing publication, but asking why information considered so sensitive had not prompted faster contact with the office that held it.

That exchange leaves two responsibilities in view: limiting further circulation of confidential and personal information, and preserving the evidence needed to establish what happened. Lee separately demanded immediate preservation of system records, which could document access without requiring wider release of the files themselves.

What the Investigation Must Establish

Lee called for a comprehensive review of server access records to determine who downloaded the documents, when exposure began and why the agency had not detected it. She also requested an investigation into whether similar weaknesses existed in other systems.

Access records may help establish when files were requested and how extensive retrieval was. They do not necessarily identify every person behind a request, especially where no login was required. A defensible account will need to distinguish recorded requests, completed downloads and any identities that investigators can actually verify.

The regulator still needs to confirm the nature of the exposed records, identify the cause and establish the full scope of the affected information. No confirmed exposure start date, count of outside recipients or finding of subsequent misuse was reported at the audit.

Lee's immediate deadline was the end of the parliamentary audit for a written report covering access blocking, the first recognition of the problem, the actual blocking time and contacts with the press. The accounts do not give a later date for publication of a completed technical investigation.

The case joins two separate accountability tests. Confidential records need effective access protection, while decisions to withhold documents from legitimate oversight need an explainable basis. Stopping the reported download method addresses the immediate route of exposure; it does not establish how long it existed or resolve the dispute over disclosure decisions.

Key Points

• Lee Sohee said her office obtained 2,672 clinical trial documents using ChatGPT without a login or password.
• Of those documents, 839 contained confidential company information and 2,208 contained staff mobile phone numbers. The categories may overlap.
• The regulator said it blocked access early on October 13, 2026, and was investigating the cause and the nature of the exposed information.
• Lee said her office notified the agency on October 11; Commissioner Oh Yoo-kyung said awareness came on October 12.
• A ten year disclosure list cited at the audit contained 96 cases, with 95 kept confidential and one released at a company's request.
• The exposure period, number of outside recipients and any misuse remain unconfirmed. Lee demanded preservation of records and a comprehensive access review.