South Korea’s SME Ministry Holds Briefing on ‘Startup for All’ Data Breach South Korea’s Ministry of SMEs and Startups held an official briefing on Monday to address a personal data breach involving its flagship startup platform ‘Startup for All,’ outlining the cause of the incident and measures to prevent recurrence.
According to the ministry, the breach exposed three categories of information — email addresses, idea summaries, and evaluation comments — all in encrypted form. Core personal data including resident registration numbers, contact details, and detailed application forms were confirmed to be unaffected.
The ministry attributed the breach to unauthorized API calls, whereby an unentitled party manipulated the system to extract restricted data. Officials classified the incident as a form of hacking. The vulnerability was traced to the addition of a successful applicant profile page, which introduced a security gap in the platform’s API that was not adequately managed.
Further compounding the controversy, a tip-off regarding lax security was reportedly submitted in May. However, the platform developer addressed the issue internally without notifying the ministry — a failure for which officials vowed to hold the developer strictly accountable.
An AI solution provider has been identified as the suspected source of the breach, but the ministry stopped short of making a formal determination, stating that “an ongoing investigation makes it difficult to confirm a specific company as responsible at this time.”
The ministry also faced criticism over its response timeline. Approximately 68 hours elapsed between the ministry’s awareness of the breach on June 15 and the notification sent to affected users on June 18. Officials explained that time was needed to determine the full scope of the leaked data and establish a victim notification process.
To support affected startup participants, the ministry announced a package of protective measures: verification and escrow services for trade secrets, legal assistance programs for future disputes, and one-on-one consultations with over 200 intellectual property and patent attorneys through its Startup One-Stop Support Center. Regional ‘Idea Protection Matching Days’ are also set to be held across all 17 cities and provinces in July, with online follow-up consultations available thereafter.
The planned launch of ‘Startup for All’ Season 2, originally scheduled for July, will be postponed to allow for security reinforcement and trust recovery. The ministry also stated that decisions on task force incentive awards will be deferred until responsibility for the incident has been clearly established.
