[For more diverse corporate information on the startups mentioned in this article, please visit the Unicorn Factory big data platform 'Data Lab'.]
The Ministry of SMEs and Startups announced on the 31st that it has released the results of a joint investigation with the National Intelligence Service regarding the personal information leak incident involving the 'All Startup Project' and will fully implement measures to strengthen security and compensate victims.
Noh Yong-seok, Acting Minister of the Ministry of SMEs and Startups (First Vice Minister), stated, "We sincerely apologize for causing concern due to the large-scale information leak," and added, "We will faithfully implement security enhancement measures to make the All Startup platform a trusted integrated gateway for the public."
According to the Ministry of SMEs and Startups, this investigation was conducted jointly with the National Intelligence Service based on system logs accumulated in the 'All Startup Platform' since May 12. The investigation revealed that some APIs (Application Program Interfaces) contained private information, which was leaked externally during the web crawling process. In particular, although the private information was encrypted, it was determined that the password keys required to decrypt them were also leaked.
The leaked information included three items: email addresses, review comments, and summaries of startup ideas within 200 characters. All 5,000 successful applicants of the All Startup Project were included in the leak target. The Ministry of SMEs and Startups explained that analysis of IPs attempting to access private information identified 39 domestic IPs.
Noh (Vice Minister) explained that the National Police Agency is investigating detailed IP records accessing APIs containing private information and their connection with artificial intelligence (AI) solution companies.
To prevent recurrence, the Ministry of SMEs and Startups has completely restructured system security. It minimized information included in APIs, deleted unnecessary functions to block external transmission of private information, and introduced a new database (DB) encryption solution. Additionally, all logs regarding API access are now recorded, and web crawling blocking functions have been upgraded.
The personal information management system has also been significantly revised. The criteria for retaining and destroying personal information, previously stored in bulk for five years after member withdrawal, have been subdivided by user type. For example, general members will have a retention period of five years from the time of withdrawal, while All Startup applicants will have a five-year retention period from their application date, with destruction times varying according to type.
The scope of startup idea management has been newly expanded to include 'idea application forms,' which are now managed as important information equivalent to personal data. The access authority system for sensitive information such as personal data has also been redesigned so that managers other than the minimum authorized personnel cannot view personal information.
The Ministry of SMEs and Startups announced that it is also promoting victim compensation measures to reduce anxiety over the leak of startup ideas. Since applications for idea protection measures began on the 1st, approximately 1,000 successful applicants of All Startup have applied. Specifically, 785 requested original certification of trade secrets, and 232 requested idea deposit services.
The Ministry of SMEs and Startups and the Korean Intellectual Property Office provide a trade secret original certification service that can be utilized from initial registration through three-year renewal and certificate issuance, supporting a service fee of 50,000 won. The Ministry of SMEs and Startups' idea deposit support assists in depositing idea application forms and provides free support up to new technology deposit (300,000 won) if the idea is advanced into technology within three years.
A total of 87 cases were reported at the victim reporting center opened on the 18th of last month, but no additional reports have been received since the 8th of this month. By type, there were 50 damage reports, 9 leak confirmation requests, 11 demands for responsibility, 8 idea protection requests, and 9 other cases. Individual guidance has been completed for all applicants, and regarding two cases raising suspicions of idea theft, results have been provided after conducting internal detailed investigations.
Furthermore, the Ministry of SMEs and Startups plans to fully implement administrative procedures equivalent to those for public information systems to restore trust in national services. Through consultations with relevant ministries, it intends to complete National Intelligence Service security reviews, pre-consultations with the Ministry of the Interior and Safety, impact assessments by the Personal Information Protection Commission, and software (SW) impact assessments by the Ministry of Science and ICT by mid-August. In addition, it will continue technical advisory services and intrusion response training with the National Intelligence Service and establish a permanent security monitoring system through external professional companies.
[MoneyToday startup media platform Unicorn Factory]
in FUTURE
