Ministry of SMEs and Startups Sanctions Data Leak Company
The Ministry of SMEs and Startups has begun disciplinary proceedings against the company responsible for leaking the personal information of participants in the “Startup for All” program. It will also conduct emergency security inspections of 49 other artificial intelligence solution providers involved in government support projects.
The breach occurred at Amicus Lex, operator of the Lawform service, which supplied AI solutions to participants in the program’s second project. A hacking attack exposed information belonging to 20,028 people, including 818 “Startup for All” participants. The compromised data included names, phone numbers, and email addresses.
Timeline of the Data Breach
Amicus Lex was reportedly attacked at 5:38 p.m. on November 11. The company detected signs of the intrusion by 8:30 p.m. and implemented emergency measures, including blocking access from overseas IP addresses.
At approximately 3 p.m. on November 12, the company confirmed that the exposed records included information belonging to 818 program participants. It reported the breach to the Korea Institute of Startup and Entrepreneurship Development at 6:10 p.m. that day.
Possible Sanctions and Service Changes
A project steering committee will consider disciplinary action against Amicus Lex. Possible sanctions include canceling the company’s selection as a service provider or restricting its participation in government projects for up to one year.
If sanctions are imposed, the company must immediately destroy all participant information retained for account creation. The Korea Institute of Startup and Entrepreneurship Development will verify whether the data has been properly deleted.
If the committee suspends the supply of Lawform services, affected participants will receive access to alternative AI solutions. To minimize disruption during the transition, the support period will be extended by one month.
People affected by the breach will also be offered legal guidance through the Startup One-Stop Support Center. Its legal advisory team will explain available procedures for seeking compensation or other remedies.
Emergency Checks for Other AI Providers
The ministry and private-sector security specialists will inspect the remaining 49 AI solution providers. The review will examine how companies retain personal information, control access, encrypt sensitive data, manage vulnerabilities, and respond to security incidents.
Providers found to have inadequate safeguards will be required to correct the problems immediately. If necessary improvements are considered impractical, the steering committee may review cancellation of the provider’s selection or impose restrictions on future participation.
Stronger Security Standards Planned
Following the incident, the government plans to strengthen security requirements for private services connected to public support programs. Officials will assess whether sharing personal information is necessary from the initial planning and project announcement stages.
Future program notices will clearly state requirements for appointing personal information protection officers and managing access privileges. Security experts will also participate in provider evaluations, while information security criteria will become a mandatory part of the selection process.
In addition, the Ministry of SMEs and Startups will establish an Information Security Management Task Force led by the first vice minister. The task force will inspect security practices across projects under the ministry’s jurisdiction and oversee broader improvements to personal data protection.
