"'Startup for All' Data Breach Caused by Hacking of Participating Firm"

The data breach of the Ministry of SMEs and Startups' "Startup for All" project, which resulted in the exposure of personal information and startup ideas of thousands of successful applicants, has been revealed to be the result of a hack by a participating company tasked with supporting project participants, rather than an external attack.

According to a "Personal Information Breach Report" submitted by the Korea Institute of Startup & Entrepreneurship Development (KISED) under the Ministry of SMEs and Startups to Representative Kang Seung-kyu of the People Power Party today (the 21st), KISED stated regarding the timing and circumstances of the breach that "on the morning of the 15th at 9:00 a.m., an AI solution company (participating in the project) obtained private email addresses through abnormal API (Application Programming Interface) calls and sent promotional emails to those addresses."

In particular, the report noted that while the private email addresses were not visible on the external interface, the company was able to acquire them through specific API calls and "web crawling," an AI-based automated data collection function.

Unlike typical hacking incidents where unidentified domestic or international hacker groups attack personal information servers through illegal means, this "Startup for All" breach involved a participating company acting as the source of the hack.

The AI solution company is responsible for supporting various AI tools to help participants develop their startup ideas in detail.

KISED explained that although access to such information was blocked on the service interface, security for some server APIs, including applicant profiles and evaluation comments, was insufficient.

As a measure to minimize damage from the breach, the agency stated it would provide a feature on its website for data subjects to check if their personal information was leaked and establish a dedicated contact point to guide victims and minimize further damage.

In addition, it noted that it has notified all 5,000 project selectees of the breach via text message and reported the personal information leak to the relevant higher authority.

The leaked items include private email addresses, evaluation comments, and summaries of startup ideas.

However, the agency stated that the exact scale of the leak requires further investigation.

Regarding this hacking incident, the Ministry of SMEs and Startups plans to hold a briefing tomorrow (the 22nd) with First Vice Minister Noh Yong-seok as the briefer, under the theme of "Current Status of 'Startup for All' and Future Operational Direction."

(Photo: Yonhap News)
※ Please note: This article was translated by AI and may contain errors.