Intrusion at LawForm operator exposes contact details of 20,028 users
South Korea’s Ministry of SMEs and Startups says an intrusion into Amicus Lex exposed names, phone numbers and email addresses of 20,028 LawForm users. The total includes 818 people in the second round of the government’s startup program.
- Disclosed
- Nov 13, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Users whose contact details were held by Amicus Lex, including 818 participants in the government startup program
- data breach · SaaS · South Korea
- In the wild
- Not applicable
What happened
Amicus Lex operates LawForm on its own systems. It was one of 50 AI solution providers for the second round of South Korea’s startup support program. The ministry says the attacker obtained users’ names, phone numbers and email addresses from the operator’s systems. The 818 program participants are part of the 20,028 affected users.
The ministry has yet to disclose the entry point or give a technical containment assessment. Blocking connections from foreign IPs was one of the operator’s immediate measures. The government said it would continue checking access controls and deletion after retention periods across the program’s suppliers.
Crime-scene timeline
Nov 11, 2026
Amicus Lex detects signs of intrusion
The company identifies suspicious activity on its own systems and takes measures including blocking access from foreign IP addresses.
Nov 12, 2026
Amicus Lex informs the startup program agency
The Korea Institute of Startup and Entrepreneurship Development works with the operator to identify affected users and data.
Nov 13, 2026
Operator sends individual notices and the ministry discloses the breach
The operator sends individual notices. The ministry and startup agency separately send guidance to affected participants.
Nov 14, 2026
Ministry posts its briefing on the policy portal
The ministry confirms that 818 participants are included in the total of 20,028 and says it will continue checking suppliers’ access and data retention practices.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- South Korean Ministry of SMEs and StartupsPrimaryIdentifies the affected operator, confirmed user counts, disclosed data fields, individual notices and planned checks of program suppliers.
- Kyunghyang ShinmunReports the ministry’s November 13 disclosure.
- Ministry press briefing PDFPrimaryOfficial briefing document describing the scope, notices and response.