Gov't startup program hit by back-to-back data breaches

The government's flagship startup support initiative, Everyone's Startup, is reeling from a string of personal data breaches. Following a leak that exposed the information of 5,000 accepted applicants in its first round, the program's second round has now seen the personal data of 818 participants compromised. The program drew more than 150,000 applicants across both rounds, but the repeated security failures are threatening to overshadow its achievements.

The Ministry of SMEs and Startups said Monday that a hacking attack on Amicus Rex — an AI solution provider for the second round of Everyone's Startup — resulted in the leak of personal data belonging to 818 program participants. The compromised information included names, phone numbers and email addresses.

Amicus Rex detected signs of an external cyberattack on its systems Wednesday. A subsequent investigation confirmed that the personal data of 20,028 users held by the company had been leaked, 818 of whom were Everyone's Startup participants. The Korea Entrepreneurship Foundation received notification of the breach from the company Thursday and verified the scope and categories of the leaked data. The ministry officially announced the breach Friday and posted an apology on its website Saturday.

The incident occurred not on the official Everyone's Startup platform operated by the ministry, but within the internal systems of a private AI solution provider. The ministry subsidizes usage fees for AI solutions from 50 private companies to help participants validate their ideas and develop them into businesses. Participants consent to sharing their personal data with third parties before using those companies' services.

This is not the first time personal data has been leaked in connection with Everyone's Startup. In June, the email addresses, evaluation comments and startup idea summaries of 5,000 first-round accepted applicants were exposed. Investigators found that some application programming interfaces on the Everyone's Startup platform had contained non-public information accessible through web crawling. Although the information was encrypted, the encryption keys were also exposed. At the time, the ministry and the Korea Entrepreneurship Foundation conducted a joint investigation with the National Intelligence Service and overhauled the platform's overall security framework.

The recurrence of a data breach just five months later has renewed concerns about security management across the program. While this incident differs from the earlier one in that it stemmed from a hack of a private vendor rather than a flaw in the official platform, the ministry is not without responsibility — the data was leaked while participants were taking part in a government-supported program.

Everyone's Startup is the government's signature startup support project, designed to lower barriers to entry so that anyone with a business idea can participate. The program drew wide attention from the outset, with President Lee Jae Myung personally highlighting it.

In fact, the program has produced tangible results beyond simply attracting applicants. As of late last month, the 1,100 participants who advanced to the second round of the first cohort had filed 287 business registrations and 640 patent applications. Private investment attracted by participants reached 3.7 billion won ($2.78 million). While the program's goal of lowering the bar for entrepreneurship and identifying new startup talent has been bearing fruit, observers say the repeated data breaches are obscuring these gains.

The second round has also struggled to sustain the buzz generated by the first, adding to the ministry's challenges. Although the number of applicants has grown, the novelty of the program has faded somewhat since its launch, and the data breach has compounded the ministry's difficulties.

The ministry has begun drawing up remedial measures. It plans to convene a program operations committee to deliberate on revoking Amicus Rex's status as a designated vendor and barring the company from participating in the program for up to one year. Emergency security inspections of the remaining 49 AI solution providers will be conducted through Friday.

The ministry will also verify compliance with personal data protection requirements and establish an information security management task force led by the first vice minister to review security frameworks across similar support programs. "As more government support programs are being linked with private services, we will use this incident as an opportunity to strengthen personal data protection management across all support programs," a ministry official said.