2026 Amicus Rex — Lawform hack; 20,028 users
Data compromised
20,028 Lawform users: names, phone numbers and email addresses. Includes 818 second-round Everyone’s Startup participants. Business-plan contents and passwords not confirmed in the ministry notice. recordsAffected 20028.
Technical writeup
Yonhap ministry notice is the census source. DailySecu and Herald add Lawform naming and SQL-injection detail. Do not merge with the June ministry-platform incident.
Root cause
Yonhap 13 November 2026: MSS said Amicus Rex (Lawform), an AI supplier on the second Everyone’s Startup round, found an external hack at 08:30 on 11 November. KISED told at 18:10 on 12 November. Users notified 13 November 15:00. Herald reporting described SQL injection on an admin page and deletion of a vulnerable API. Second programme-adjacent leak after June (~5,000 on the ministry platform itself). This row is the vendor, not a second copy of the June ministry incident. Also romanized Amicus Lex.