The Ministry of SMEs and Startups is reviewing sanctions against the private AI solution provider involved in the data breach of participants in the 'Everyone's Startup' program, including the cancellation of project selection. The ministry announced on November 15 that it will conduct emergency security checks on 49 other suppliers.
Initially, the ministry will hold a business operation committee meeting regarding Amicus Rex, the operator of the AI solution 'Rofom,' to deliberate on potential sanctions, including project selection cancellation and a one-year participation ban.
If sanctions are imposed, the affected company will be required to immediately destroy any personal data of participants it holds for account issuance.
Should the supply of the company's AI solution be halted, users will be supported in utilizing alternative solutions with similar functionalities, and the support period will be extended by one month to cover any service transition gaps.
Victims of the data breach will be guided through the recovery process and application methods by the legal advisory group at the 'Startup One-Stop Support Center.'
The ministry will also assess the data protection measures of the 49 other AI solution providers in collaboration with a private security firm by November 20, checking their data retention status, access rights, encryption, vulnerability management, and incident response systems.
Any deficiencies identified will need to be promptly addressed, and companies unable to comply will face project selection cancellation and participation restrictions after a review by the business operation committee.
In light of this incident, the ministry plans to strengthen the data protection management system for all government support projects. This includes pre-evaluating the necessity of personal data provision from the planning and announcement stages and specifying the designation of data protection officers and access rights management obligations in project announcements.
Additionally, the evaluation committee for supplier selection will now include data security experts, and information security criteria will be mandatory in the evaluation scoring.
To facilitate these measures, a 'Information Security Management Task Force' (TF) will be established, led by the first vice minister of the ministry.
This response follows a hacking incident involving Rofom, which resulted in the personal data of 20,028 individuals being leaked, including names, contact information, and email addresses of 818 program participants.
On November 14, the ministry and the Startup Promotion Agency issued an apology on the project website, stating, 'As the organization operating the Everyone's Startup support program, we take this incident very seriously.'
Concerns about potential data leaks were also raised regarding the Yellow Umbrella website operated by the Korea Federation of Small and Medium Businesses. Established in 2007, the Yellow Umbrella program supports retirement savings for small businesses and has 1.92 million registered members.
On November 14, the Korea Federation of Small and Medium Businesses stated through the Yellow Umbrella website, 'We will promptly verify the actual inquiry status and the extent of the damage and take necessary measures to prevent recurrence. We sincerely apologize for any concerns caused.'
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.