818 participants in second round of 'Modu-ui Changup' had personal data exposed
Operator Amicus Lex faces possible disqualification and participation ban
Victims to receive legal support; replacement AI solutions to be provided
Security audits of 49 supplier firms to be completed by Friday
The Ministry of SMEs and Startups said Sunday it will consider sanctions against an AI solution provider implicated in a personal data breach affecting participants in the government startup support program "Modu-ui Changup," while launching emergency security audits of the remaining 49 AI solution suppliers.
The breach occurred in Roform, an AI solution operated by private firm Amicus Lex, which supports startup activities for second-round program participants. On Wednesday at 8:30 a.m., Amicus Lex detected signs of an external hacking attempt in its own system, and a subsequent investigation confirmed that personal data had been leaked. A total of 20,028 individuals had their information exposed, including 818 second-round participants whose names, phone numbers and email addresses were among the compromised data.
Under the second round of Modu-ui Changup, the ministry subsidizes participants' use of private AI solutions to help them validate business ideas and develop them into viable ventures. A total of 50 supplier companies operate services through their own systems, and participants consent to sharing their personal data with third parties when registering for accounts.
The ministry plans to convene a program operations committee to deliberate on whether to impose sanctions on Amicus Lex. Under the program's detailed management guidelines and public notices, options under review include canceling the firm's supplier designation and barring it from participating in the program for up to one year.
If the committee decides to impose sanctions, the ministry will require Amicus Lex to immediately destroy all participant personal data it holds for account registration purposes. The Korea Entrepreneurship Foundation will verify that the data has been properly deleted.
Should the company's AI solution supply be suspended, the ministry will notify affected participants and provide alternative AI solutions with comparable functions. To minimize disruption during the transition, the ministry also plans to extend the solution support period by one month.
Participants whose personal data was exposed will be guided through the damage relief process and application procedures via the legal advisory team at the Startup One-Stop Support Center.
The ministry will also tighten security checks on other AI solution providers. Working with a private cybersecurity firm, it plans to audit the personal data protection practices of the remaining 49 supplier companies by Friday.
The audits will cover data retention status, access controls, encryption, vulnerability management and incident response systems. Any deficiencies found must be remedied immediately, and suppliers unable to make the required improvements will be referred to the program operations committee for possible disqualification or participation restrictions.
The breach occurred not on the official Modu-ui Changup platform but within the private system of an AI solution supplier, highlighting the information security risks that arise when government support programs share participant data with outside firms. The incident has prompted calls for more rigorous vetting of private suppliers' data protection capabilities from the selection stage onward.
The ministry said it will also strengthen personal data protection frameworks across similar support programs. Starting from the planning and public announcement stages, it will review the necessity of sharing personal data and plans to make it mandatory for suppliers to designate a personal data protection officer and manage access controls.
During the supplier selection process, the ministry will require that at least one information security expert sit on evaluation panels, and information security criteria will be factored into scoring. Related guidelines will also be revised to require security compliance checks — including access controls and connection log management — both before services launch and during operations.
To oversee these efforts, the ministry will establish an information security management task force led by the first vice minister to conduct a comprehensive review of security management practices across all support programs.
boo@heraldcorp.com
