Email addresses of 5,000 successful applicants, summaries of startup ideas, and judges' comments from the Ministry of SMEs and Startups' startup support project "Everyone's Startup" were found to have been exposed externally through some of the platform's application programming interfaces (APIs). The government will push measures to prevent a recurrence, including an API overhaul and improvements to the personal information management system.
No Yong-seok, the 1st Vice Minister of the Ministry of SMEs and Startups (MSS) and acting Minister, said at a press briefing at Government Complex Seoul on the 31st, "Through a joint investigation with the National Intelligence Service (NIS), we confirmed how and to what extent information was leaked," and added, "We will strengthen the platform's security and completely overhaul the personal information management system to prevent a recurrence."
The investigation found that some APIs of the "Everyone's Startup platform" contained nonpublic information, and that the information was leaked as the APIs were collected through web crawling. The nonpublic information was encrypted, but the encryption key was also exposed.
The leaked information includes ▲ email addresses ▲ judges' comments ▲ summaries of startup ideas within 200 characters. The IPs that attempted to access the nonpublic information were identified as 39 domestic IPs.
"Everyone's Startup" is the Ministry of SMEs and Startups (MSS)'s flagship startup project that supports anyone in the public to try starting a business as long as they have an idea. In the first cohort this year, about 63,000 people applied, and 5,000 were selected.
To prevent a recurrence, the Ministry of SMEs and Startups (MSS) has completely revamped the platform's security system. It conducted a full review of the APIs to minimize included information and deleted unnecessary functions, and introduced a new encryption solution to protect databases.
It also strengthened the system for detecting and blocking abnormal access by logging all access to the APIs in system logs and enhancing the function to block web crawling attempts.
The personal information management system will also be improved. Personal information that had been stored for five years after membership withdrawal will now be subject to differentiated retention and disposal standards depending on the subscriber type, and startup idea applications will be included within the scope of personal information management and treated as important information. Access rights to sensitive information have also been redesigned so that only the minimum authorized personnel can view personal information.
To ease the anxiety of successful applicants caused by the information leak, the Ministry of SMEs and Startups (MSS) also began supporting idea protection. It is supporting trade secret original proof and idea escrow expense, and since on the 1st, about 1,000 successful applicants have applied for protection measures. Of these, 785 used trade secret original proof and 232 used idea escrow.
In addition, "Idea Consulting Day," involving more than 120 experts in the intellectual property field, was held in 17 metropolitan and provincial regions, providing consultations to about 600 people. Since the opening of the damage report center on the 18th of last month, a total of 87 cases have been filed, and two cases raising suspicions of idea theft have undergone separate investigations.
The investigation found that although there were allegations that a site containing an item similar to a whistleblower's submitted startup idea had been newly created, the site in question had been created before the start of the "Everyone's Startup" program. The Ministry of SMEs and Startups (MSS) informed the whistleblowers of the investigation results.
Going forward, the Ministry of SMEs and Startups (MSS) plans to implement security procedures at the level of public information systems. By mid-Aug., it will complete related procedures, including a security review by the National Intelligence Service (NIS), prior consultation with the Ministry of the Interior and Safety, a personal information impact assessment, and a software impact assessment, and it will also establish a constant security inspection system with external security monitoring corporations.
The platform operator will not be replaced and will focus on addressing security vulnerabilities while maintaining the current system. The plan is to improve the existing platform architecture to raise the security level.
The Ministry of SMEs and Startups (MSS) plans to consider launching the second cohort of "Everyone's Startup" after mid-Aug., when system reinforcement measures are completed. Vice Minister No said, "We are working to complete the reinforcement measures as quickly as possible and are considering recruiting for the second cohort around mid-Aug."
Meanwhile, at on-site roundtables conducted by the Ministry of SMEs and Startups (MSS) in 17 metropolitan and provincial regions, concerns about information leaks were raised along with calls to expand the startup support system. In response, the ministry said it has promoted guidance on purchasing overseas AI solutions, held AI solution demonstrations, and launched the "Founders' Circle," where senior founders and successful applicants can network.