Personal information of 818 participants in the 'Everyone's Startup' program, a support initiative by the Ministry of SMEs and Startups, was leaked due to a hacking incident involving a private AI solution company.
On November 13, the ministry reported that 'AmicusRex,' one of the 50 AI solution providers for the second phase of 'Everyone's Startup,' detected signs of an external hacking attack on its system at 8:30 a.m. on November 11.
Subsequent investigations revealed that a total of 20,028 personal records were compromised, including those of the 818 participants in the second phase of the program.
To validate ideas and commercialize projects, 50 external AI solution providers operated their systems directly, with the ministry subsidizing the costs for participants. It was reported that the selection process for these providers included an evaluation of their data security measures.
Participants consented to the sharing of their personal information with third parties necessary for issuing accounts for the chosen AI solutions.
On November 12 at 6:10 p.m., the Startup Promotion Agency was informed of the incident by AmicusRex and confirmed the details of the leaked data. The breach resulted in the exposure of users' names, phone numbers, and email addresses.
Immediately following the incident, AmicusRex implemented technical security measures, including blocking access from foreign IP addresses. By 3 p.m. on November 13, the company individually notified the affected users about the data breach.
In addition to the notifications from AmicusRex, the ministry and the Startup Promotion Agency provided the affected participants with information regarding the incident, the nature of the leaked data, and preventive measures against secondary damages such as smishing.
Furthermore, the ministry requested that other AI solution providers involved in 'Everyone's Startup' assess the security status of their systems and the management of personal data to prevent similar incidents.
The ministry and the Startup Promotion Agency stated, 'We are working to prevent further damage while continuously monitoring and managing the implementation of personal data protection measures, including access rights management and data disposal after retention periods, across all AI solution providers involved in the program.'
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.