MSS's Second 'Everyone's Startup' Project Hit by Another Personal Data Breach Five Months Later

[Financial News] Personal information was leaked again in the second Everyone's Startup project. With another breach caused by a similar hacking method occurring just five months after the first incident, it will be difficult to avoid criticism that measures to prevent a recurrence were inadequate.
On the 13th, the Ministry of SMEs and Startups said the government detected signs of an external hacking attack at 8:30 a.m. on the 11th at Amicus Lex (solution name: Loform), one of the AI solution providers for the second project. The AI solutions company supports the use of various AI applications to help participants develop their startup ideas in greater detail.
The attack exposed the personal information of a total of 20,028 people held by the company. This included the personal information of 818 participants in the second Everyone's Startup project.
The Korea Institute of Startup & Entrepreneurship Development, an agency under the MSS, received notice of the incident from Amicus Lex on the 12th.
The attack exposed the names, phone numbers and email addresses of users of the AI solution held and managed by Amicus Lex.
According to the MSS, Amicus Lex implemented technical security measures immediately after the incident, including blocking access from overseas IP addresses. At 3 p.m. the following day, the 13th, it individually notified users whose information had been confirmed as exposed.
The MSS and the Korea Institute of Startup & Entrepreneurship Development also informed project participants about the circumstances of the incident, the data exposed and ways to prevent secondary harm, including smishing.
It also asked the other AI solution providers for Everyone's Startup to review the security of their own systems and their personal information management practices to prevent similar incidents.
In June this year, the MSS also suffered a data breach in the first Everyone's Startup project after an AI solutions company was hacked. The exposed information included the email addresses, evaluation comments and startup idea summaries of 5,000 people selected for the project.
At the end of July, the MSS announced measures to prevent a recurrence, including recording all access to application programming interfaces (APIs, connections between computers or software) in system logs and upgrading functions to block web-crawling attempts.
The first incident occurred on the Everyone's Startup platform, while the second occurred at a company participating in the project. But because both breaches targeted the same vulnerability, questions are being raised about the effectiveness of the security measures the government has put in place.
The MSS said, “The MSS and the Korea Institute of Startup & Entrepreneurship Development were informed of the personal information breach through the company at 6:10 p.m. on the 12th, and are working to prevent further harm and take necessary steps, including determining the circumstances of the incident.”
[email protected] Kim Hyeon-cheol Reporter