Noh Yong-seok, acting minister and first vice minister of the Ministry of SMEs and Startups, briefs reporters at the Government Complex Seoul annex in Jongno-gu, Seoul, on Friday about the data leak from the Modu's Startup project and the ministry's follow-up plans. [Yonhap]
Noh Yong-seok, acting minister and first vice minister of the Ministry of SMEs and Startups, briefs reporters at the Government Complex Seoul annex in Jongno-gu, Seoul, on Friday about the data leak from the Modu's Startup project and the ministry's follow-up plans. [Yonhap]

A government-backed startup initiative launched with a large budget has been found to have a security flaw in its platform design. The Ministry of SMEs and Startups said the leak of personal data belonging to 5,000 first-round applicants stemmed from inadequate application programming interface (API) design, and announced a full overhaul of the platform's security framework.

First Vice Minister Noh Yong-seok held a briefing at the Government Complex Seoul on Friday morning to announce the findings of a data leak investigation into the Modu's Startup platform, conducted jointly with the National Intelligence Service, along with plans for follow-up measures.

Data leak hits government project with record participation

Modu's Startup is a nationwide entrepreneurship project designed by the government and private sector to allow anyone to pursue a startup venture, offering support across the entire process — from idea validation to commercialization and investment linkage. A total of 62,944 people applied, setting a record for the largest number of participants in any government ministry competition. The project drew a budget of 62.8 billion won ($43.6 million). A personal data breach on June 18 sparked controversy, however, prompting the ministry to issue a formal apology and request a police investigation.

The ministry had earlier said the breach involved the leak of encrypted information through abnormal API calls. At Friday's additional briefing, it said some APIs contained private information that was exposed when the APIs were collected via web crawling. "The private information was encrypted, but it was leaked along with the rest," Noh said.

The breach affected 5,000 first-round applicants. According to the ministry, the leaked information included email addresses, evaluation comments and startup idea summaries of up to 200 characters. Thirty-nine domestic IP addresses were identified as having attempted to access the private data. "The Korean National Police Agency is investigating the details of the IP addresses and their possible connection to an AI solutions company," Noh said.

Noh Yong-seok, first vice minister of the Ministry of SMEs and Startups, speaks at a Modu's Startup forum held at Sungkyunkwan University's natural sciences campus in Suwon, Gyeonggi Province, on April 24. [Ministry of SMEs and Startups]
Noh Yong-seok, first vice minister of the Ministry of SMEs and Startups, speaks at a Modu's Startup forum held at Sungkyunkwan University's natural sciences campus in Suwon, Gyeonggi Province, on April 24. [Ministry of SMEs and Startups]

Web crawling exposed personal data; encryption keys also leaked

Noh said the ministry's damage reporting center had received 87 complaints since June 18. Two cases alleging idea theft were both found to be without issue following investigation, he said. He added that since the ministry began accepting applications for idea protection measures on July 1, it had supported 1,000 applicants through services including trade secret original certification and idea escrow.

The ministry said it had completely overhauled the platform's security framework following the incident. It reviewed all platform APIs to minimize the information they contained and removed unnecessary functions to prevent private data from being transmitted. It also introduced a new database encryption solution to strengthen the personal data encryption system, upgraded system logging of all API access, and enhanced its ability to detect and block web crawling attempts.

The ministry also revised its personal data management practices. Previously, personal data for both general members and project applicants was retained for five years after account deletion. Going forward, general members' personal data will be deleted immediately upon account deletion, while project applicants' data will be retained for five years from the date of application.

Startup idea application forms will also be brought under the scope of personal data management and treated as sensitive information on a par with personal data. Access rights to sensitive information, including personal data, have been redesigned so that only the minimum number of authorized personnel can view it.

"We will build security procedures that meet the standards of public information systems," Noh said. The ministry plans to complete all security and administrative procedures to that standard by mid-August, following consultations with relevant government agencies. It will also decide whether to begin recruiting for a second cohort of Modu's Startup once the platform overhaul is complete.

Second Modu's Startup cohort to launch after platform overhaul

The second cohort of Modu's Startup is expected to launch in mid-August. The ministry plans to recruit 10,000 participants — twice the size of the first cohort — and will proceed as soon as the platform security overhaul and related procedures are finalized.

"The second cohort is a project funded through a supplementary budget," Noh said. "Supplementary budget funds generally need to be spent within the fiscal year, and demand and expectations from the startup community are high." The budget allocated for the second cohort stands at around 200 billion won.


boo@heraldcorp.com