Startup program delayed after 5,000 participants' data leaked in hack

South Korea's Ministry of SMEs and Startups (MSS) has announced the postponement of the second phase of its 'Everyone's Startup' program following a significant data breach that exposed the personal information of 5,000 participants. The ministry issued a formal apology for the incident, which compromised participants' emails, ideas, and evaluation feedback.

“

We deeply apologize to everyone who participated in and showed interest in 'Everyone's Startup' for the inconvenience caused by the platform leak and for failing to maintain trust in the government.

According to Noh Yong-seok, the First Deputy Minister of MSS, the investigation has not yet confirmed direct access to the main database, and crucial information like resident registration numbers and contact details were not leaked. However, to mitigate potential risks, the ministry will provide protective measures for all 5,000 participants. These include free registration of intellectual property rights for their submitted ideas and one year of free technology deposit services for registered businesses.

The ministry is also offering one-on-one consultations with approximately 200 intellectual property and patent lawyers. A dedicated information leakage response team has been established within the Korea Institute of Startup & Entrepreneurship Development to handle damage reports and subsequent responses. Deputy Minister Noh indicated that the ministry is exploring legal avenues to support participants if disputes escalate to litigation.

“

The biggest problem in this incident is that we failed to maintain trust in the government. Restoring trust through platform improvement is the priority.

Concerns have been raised about the potential involvement of an AI solution provider that supplied services to the platform. While the MSS is cautious about naming specific companies, investigations are underway into nine IP addresses that made abnormal API calls. The ministry acknowledged that communication reached participants who had not disclosed their emails, adding to the complexity of the breach. The delay in notifying victims, which took approximately 68 hours after the initial detection, was attributed to the time needed to confirm the scope of the leak and establish response procedures. The ministry also revealed that a previous report of information exposure in May was not properly reported by the platform developer, and accountability for that oversight is being pursued.

“

As the minister of the responsible ministry, I feel a heavy responsibility and deeply regret this.