'Startup for All' platform praised by president hit by encryption key leak

No Yong-seok, acting minister and first vice minister of the Ministry of SMEs and Startups, briefs reporters at the Government Complex Seoul in Jongno-gu on Friday on the data breach at the Startup for All platform and the ministry's follow-up plans. "I apologize for the serious concern caused by the large-scale data leak," No said. [Yonhap]

A government startup initiative publicly praised by President Lee Jae Myung has been found to have had a serious security flaw in its platform design. An investigation determined that web crawling — the automated process of browsing websites to collect data — exposed private information and even encryption keys stored within the platform's application programming interfaces.

No Yong-seok, first vice minister of the Ministry of SMEs and Startups, held a briefing at the Government Complex Seoul on Friday to announce the findings of a data breach investigation conducted jointly with the National Intelligence Service, along with plans for follow-up measures. "Some APIs contained private information, and that information was leaked when the APIs were collected through web crawling," No said. He added that while the private information had been encrypted, the encryption keys were also exposed in the breach.

The personal data of 5,000 first-round applicants was compromised. According to the ministry, the leaked information included email addresses, evaluation comments and startup idea summaries of up to 200 characters. A total of 39 domestic IP addresses were identified as having attempted to access the private data. The Korean National Police Agency is investigating the specific IP details and any possible links to AI solution companies.

No said 87 complaints had been filed with the damage reporting center since June 18. Two cases in which idea theft was alleged were both cleared after the ministry conducted its own review. No added that since the ministry opened applications for idea protection measures on July 1, it had supported the protection of ideas submitted by 1,000 applicants through services including trade secret original certification and idea escrow.

Prime Minister Han Seong-sook, then serving as minister of SMEs and Startups, delivers opening remarks at the launch ceremony for the Startup for All project held in Gangnam-gu, Seoul, on March 25. [Ministry of SMEs and Startups]

Ministry of SMEs and Startups overhauls security after embarrassing breach

Startup for All is a nationwide entrepreneurship initiative jointly designed by the government and private sector to give anyone the chance to launch a business. The program supports participants through every stage — from idea validation to commercialization and investment matching — and drew 62,944 applicants, the largest turnout ever recorded for a government ministry competition. The project drew on a budget of 62.8 billion won ($43.6 million). But the industry was thrown into turmoil when a personal data breach occurred on June 18. Prime Minister Han Seong-sook, who was serving as minister at the time, issued a formal apology, and the ministry referred the case to police for investigation.

Startup for All had been a flagship initiative: President Lee Jae Myung publicly praised its results, and Han's stewardship of the project at the Ministry of SMEs and Startups is widely seen as having contributed to her appointment as prime minister. The ministry had also promoted the record-breaking applicant numbers to build momentum around the program and awarded the Startup for All task force 37 million won in prize money. The data breach, however, has embarrassed the ministry and tarnished the profile of a project it had championed so prominently.

President Lee Jae Myung posted a public message of praise for Startup for All on X (formerly Twitter) on May 15. [Captured from President Lee's X account]

The Ministry of SMEs and Startups is working to contain the fallout. No said the ministry had completely overhauled the platform's security architecture following the incident. It reviewed all platform APIs to minimize the data they carry and removed unnecessary functions to prevent private information from being transmitted. The ministry also introduced a new encryption solution to strengthen the personal data encryption framework, and upgraded its systems to log all API access and detect and block web crawling attempts.

The ministry also revised its personal data management policy. Previously, personal data for both general members and project applicants was retained for five years after account deletion. Going forward, general members' data will be deleted immediately upon account cancellation, while project applicants' data will be kept for five years from the date of application.

Startup application documents will now be classified as sensitive information on a par with personal data and managed accordingly. Access rights to sensitive information, including personal data, have also been redesigned so that only the minimum number of authorized personnel can view it.

No said the ministry would build security procedures meeting the standards of public information systems. Working with relevant government agencies, the ministry plans to complete all required security and administrative procedures to that standard by mid-August. The ministry also said it would decide whether to open recruitment for the second phase of Startup for All once the platform overhaul is finished.

No Yong-seok, first vice minister of the Ministry of SMEs and Startups, delivers remarks at an on-site meeting with operators and mentoring organizations for the Startup for All program covering the Greater Seoul area — Seoul, Gyeonggi Province, Incheon and Gangwon Province — held at the Seoul Creative Economy Innovation Center in Yongsan-gu, Seoul, on July 15. [Ministry of SMEs and Startups]

Second phase of Startup for All to launch after platform fixes

The second phase of Startup for All, which aims to recruit 10,000 participants — roughly double the first cohort — is expected to launch in mid-August. The ministry said it plans to proceed as quickly as possible once the platform security overhaul and related procedures are complete, noting that public demand for the second phase is considerable.

"The second phase is a project funded through the supplementary budget," No said. "Supplementary budget funds generally must be spent within the fiscal year, and there is strong demand and high expectations from the startup community." The second phase of Startup for All has been allocated about 200 billion won.

No added that the ministry would work to restore public trust in the Startup for All platform and make it a unified gateway for entrepreneurial ambition.

boo@heraldcorp.com