{
  "id": "lawform-user-data",
  "url": "https://ohshit.app/incidents/lawform-user-data/",
  "title": "Intrusion at LawForm operator exposes contact details of 20,028 users",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-13",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "data breach",
    "SaaS",
    "South Korea"
  ],
  "ecosystems": [],
  "summary": "South Korea’s Ministry of SMEs and Startups says an intrusion into Amicus Lex exposed names, phone numbers and email addresses of 20,028 LawForm users. The total includes 818 people in the second round of the government’s startup program.",
  "splash": "Users whose contact details were held by Amicus Lex, including 818 participants in the government startup program",
  "wipe": "Verify the notice through LawForm or the startup program and report suspicious messages that use the exposed details.",
  "in_the_wild": "n/a",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify any breach notice independently",
      "hint": "Open LawForm or the startup program through a known address and use its existing support channel. Ask whether your account is in the affected set if you have yet to receive an individual notice."
    },
    {
      "title": "Watch for phishing using your contact details",
      "hint": "Verify unexpected messages about startup funding or LawForm through a known support channel. Avoid links in suspicious messages and keep credentials and one-time codes private. Report suspicious messages to the relevant service."
    },
    {
      "title": "Check how your program integrations handle contact data",
      "hint": "Review account provisioning, permissions and stored participant data at each provider. Remove access and delete copies when their retention period ends, and preserve relevant access records if you are investigating exposure."
    }
  ],
  "sources": [
    {
      "name": "South Korean Ministry of SMEs and Startups",
      "url": "https://m.korea.kr/briefing/actuallyView.do?newsId=148975732&pageIndex=1&repCode_F=",
      "says": "Identifies the affected operator, confirmed user counts, disclosed data fields, individual notices and planned checks of program suppliers.",
      "primary": true
    },
    {
      "name": "Kyunghyang Shinmun",
      "url": "https://www.khan.co.kr/en/article/202611131742007",
      "says": "Reports the ministry’s November 13 disclosure.",
      "primary": false
    },
    {
      "name": "Ministry press briefing PDF",
      "url": "https://www.korea.kr/common/download.do?fileId=198590199&tblKey=PMN",
      "says": "Official briefing document describing the scope, notices and response.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": null,
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 11, 2026",
      "title": "Amicus Lex detects signs of intrusion",
      "body": "The company identifies suspicious activity on its own systems and takes measures including blocking access from foreign IP addresses."
    },
    {
      "date": "Nov 12, 2026",
      "title": "Amicus Lex informs the startup program agency",
      "body": "The Korea Institute of Startup and Entrepreneurship Development works with the operator to identify affected users and data."
    },
    {
      "date": "Nov 13, 2026",
      "title": "Operator sends individual notices and the ministry discloses the breach",
      "body": "The operator sends individual notices. The ministry and startup agency separately send guidance to affected participants."
    },
    {
      "date": "Nov 14, 2026",
      "title": "Ministry posts its briefing on the policy portal",
      "body": "The ministry confirms that 818 participants are included in the total of 20,028 and says it will continue checking suppliers’ access and data retention practices."
    }
  ],
  "body_markdown": "Amicus Lex operates LawForm on its own systems. It was one of 50 AI solution providers for the second round of South Korea’s startup support program. The ministry says the attacker obtained users’ names, phone numbers and email addresses from the operator’s systems. The 818 program participants are part of the 20,028 affected users.\n\nThe ministry has yet to disclose the entry point or give a technical containment assessment. Blocking connections from foreign IPs was one of the operator’s immediate measures. The government said it would continue checking access controls and deletion after retention periods across the program’s suppliers."
}