AI solution provider for second 'Modu's Startup' program hacked
Total of 20,028 users' personal data exposed
Names, phone numbers, email addresses compromised
Ministry of SMEs and Startups requests security checks from other suppliers
Personal data belonging to 818 participants in the government-run second Modu's Startup program was leaked after hackers attacked a private AI solution provider contracted for the initiative, the Ministry of SMEs and Startups said Friday.
According to the ministry, the breach occurred at Amicus Rex, an AI solution provider for the second Modu's Startup program, exposing the personal data of 20,028 users in total. Of those, 818 were confirmed to be program participants.
Amicus Rex operates an AI solution called Roform. The company detected signs of an external hacking attempt in its systems at 8:30 a.m. Wednesday and subsequently confirmed the data leak during its investigation.
The compromised information includes users' names, phone numbers and email addresses. The Korea Startup Promotion Agency received notification of the incident from Amicus Rex at 6:10 p.m. Thursday and worked with the company to identify the scope and categories of the leaked data.
Under the second Modu's Startup program, the government subsidizes participants' use of private AI solutions to help them validate business ideas and develop them into viable ventures. A total of 50 AI solution providers operate their services through their own systems, and participants must consent to sharing their personal data with third parties before receiving account access.
Following the breach, Amicus Rex blocked access from overseas IP addresses and implemented other technical security measures. On Friday afternoon, the company individually notified all users whose personal data had been confirmed as leaked.
The Ministry of SMEs and Startups and the Korea Startup Promotion Agency also informed program participants of the circumstances of the incident, the categories of data exposed, and precautions to take against secondary damage such as smishing attacks.
A similar incident occurred earlier this year, when the personal data of 5,000 applicants accepted into the first Modu's Startup program — along with information related to their startup ideas — was leaked in June. That breach exposed email addresses, startup idea summaries and evaluation comments. The ministry referred the case to police and arranged for all affected applicants to register their business ideas as certified trade secrets. Despite those measures, the recurrence of a data leak in the second round of the program has renewed scrutiny over the security of participant information.
"We will work to prevent further damage and will continuously monitor and manage the personal data protection practices of all AI solution providers in the Modu's Startup program — including how they control access to personal data and whether they are properly destroying data after its retention period expires," a ministry official said.
boo@heraldcorp.com
