Amicus Lex hack exposes personal data of 20,028 users
A hack at Amicus Lex at 5:38 am on 11 November exposed the names, phone numbers and email addresses of 20,028 LawForm users. An SQL injection attack targeting the administrator page and a vulnerable API were identified, and the vulnerable API code was deleted. The Ministry of SMEs and Startups disclosed the incident approximately 60 hours after becoming aware of it.
Key facts
- Affected organisation
- Amicus Lex
- Incident type
- Data breach
- Occurred / detected
- 2026-11-11
- Scale of damage
- Personal information of 20,028 LawForm users
- Cause / method
- An SQL injection attack on the administrator page and exploitation of a vulnerable API
- Location
- South Korea
If your data was exposed
Exposed dataNamePhone numberEmail
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
- If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Centre ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗
Timeline
- A personal data breach occurred at Amicus Lex at 5:38 am.
- The total number of affected LawForm users was confirmed as 20,028, and the SQL injection attack and deletion of vulnerable API code were disclosed.
- Participants in the Modu-ui Changup entrepreneurship programme demanded disclosure of the circumstances of the incident and compensation measures.
Also affected by this incident
Hack exposes data of 818 participants in ministry's Entrepreneurship for All programme
↳ Knock-on damage from the Amicus Lex incident · View original incident818Impact: Personal information of 818 Entrepreneurship for All participants
The names, telephone numbers and email addresses of 818 participants in the second round of the Ministry of SMEs and Startups' Entrepreneurship for All programme were leaked following a hack of AI solution provider Amicus Lex. Amicus Lex detected signs of hacking in its systems on 11 November. An SQL injection attack targeting the admin page was confirmed, and the company deleted vulnerable API code, blocked access from overseas IP addresses and notified those affected individually.
Related reports: 43 · last report →
1 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.