Startup for All: AI Solution Provider Again Becomes a Security Weak Point

Information Leaked from AI Solution Provider
Ministry of SMEs and Startups to Strengthen Oversight and Inspections of Private Services

A personal information leak involving participants in the second round of “Startup for All” has prompted criticism of security vulnerabilities at artificial intelligence (AI) solution providers. In the first round, nonpublic information about 5,000 successful applicants was exposed when an AI solution provider collected APIs (application programming interfaces) to promote its own solution. This time, information was leaked after an AI solution provider’s platform was targeted in a hacking attack. The Ministry of SMEs and Startups plans to conduct security inspections of all AI solution providers for the Startup for All program.

On November 15, the ministry said it would strengthen the management and inspection of personal information protection not only for systems operated directly by the government but also for private services linked to government support programs.

Unlike the information leak involving the first round of Startup for All last June, the system affected by this incident was a platform operated independently by the private company Amicus Lex. Private-sector AI solution providers operate their solutions directly on their own systems. When participants choose a provider, the ministry covers the cost of using that service. At around 8:30 a.m. on November 11, Amicus Lex detected signs of an external hacking attack on its system. An investigation confirmed that personal information belonging to 20,028 people had been leaked, including information about 818 participants in the second round of Startup for All. The leaked information reportedly included the names, phone numbers and email addresses of users of AI solutions that Amicus Lex held and managed.

Unlike the leak in the first round of Startup for All, this time a private AI solution provider was targeted. However, this has heightened participants’ concerns, as 50 companies are providing AI solutions in the second round and each operates its solutions on its own system. Participants use the services after consenting to the third-party provision of the personal information required to set up an account for their chosen AI solution. This means that 50 AI solution providers hold some information about participants in the second round, and that hacking attacks like the one at Amicus Lex could also occur at other providers. Moreover, if participants uploaded information about their technologies or ideas to use an AI solution, the damage could be even greater in the event of a hacking incident.

As an AI solution provider was also the starting point of the information leak in the first round, questions have been raised about whether the selection process for the providers was properly conducted. Last month, the ministry said that an evaluation committee made up of AI and software (SW) technology experts had directly tested the solutions and assessed their general applicability, technological and pricing suitability, and security, among other factors. It said it had selected 103 solutions from 50 providers. The ministry said, “We will promptly conduct further checks to establish the exact circumstances of the incident and determine the necessary measures, and will provide transparent updates on our follow-up response to ease participants’ concerns.” It added, “We will fulfill our responsibility to protect those affected and take the necessary follow-up measures so participants can take part in the program with confidence.”

This content was produced with the assistance of AI translation services.